# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.110.112.186
country_id: 732800
description:
Jan 13 19:24:19 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.110.112.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.163.38.102
country_id: 3077311
description:
Jan 13 19:25:16 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.163.38.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.246
country_id: 690791
description:
Jan 13 19:25:35 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.246 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.208.81.125
country_id: 6252001
description:
Jan 13 19:27:50 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.208.81.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-01-13 19:27:52 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (bented) [73.208.81.125]:59538: 535 Incorrect authentication data (set_id=sabi@tujusetia.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.172.198.124
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=735818 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.135.145
country_id: 1269750
description:
Jan 13 19:28:42 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.135.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.250.111
country_id: 3469034
description:
Jan 13 19:28:27 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.250.111 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/images/login.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.224
country_id: 3175395
description:
Jan 13 19:33:30 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.224 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/images/contact.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.41.175.52
country_id: 798544
description:
Jan 13 19:33:48 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.41.175.52 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.60.66
country_id: 1819730
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/assets/images/logooo.png HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.16.155
country_id: 248816
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=594602 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.125.133.85
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=464199 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 19:39:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60455: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.114.151.204
country_id: 953987
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/logos/logo.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.105.81.227
country_id: 3865483
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/assets/js/bxslider/images/bx_loader.gif HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.74.11.107
country_id: 1210997
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/about-photo.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.139.63.42
country_id: 248816
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/testimonials/liquid.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.255.126.47
country_id: 3469034
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/testimonials/dirt.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.32.32.169
country_id: 3469034
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/portfolio/chair.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.154.209
country_id: 99237
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/bg4324.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 19:39:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60456: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.179.16.98
country_id: 1210997
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/banner3.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.230.205.230
country_id: 3865483
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/portfolio/sofa.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.15.230.46
country_id: 3469034
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/testimonials/dust.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.152.141
country_id: 99237
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/blog/tensile.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.12.121.68
country_id: 1168579
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/portfolio/bedheadband.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.235.235.31
country_id: 1269750
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/backgrounds/arrow-2.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.237.164.144
country_id: 192950
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/portfolio/hair.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.222.113.249
country_id: 3923057
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/bg42341.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.13.193.100
country_id: 1210997
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/portfolio/wrinkle.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.27.75.25
country_id: 3865483
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/blog/flex.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.213.49.33
country_id: 192950
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.0.7.238
country_id: 1210997
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/portfolio/veins.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.93.226.226
country_id: 3469034
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/blog/tear.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.2.100.248
country_id: 3865483
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/vendor/rs-plugin/css/layers.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.43.135.39
country_id: 2635167
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/googlemap2.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.175.45.64
country_id: 3865483
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/vendor/rs-plugin/js/jquery.themepunch.tools.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.77.72.215
country_id: 1269750
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/portfolio/scars.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.123.241.187
country_id: 1269750
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/vendor/rs-plugin/js/jquery.themepunch.revolution.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.48.71.186
country_id: 1210997
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/vendor/jquery/jquery.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.204.141.22
country_id: 1210997
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/banner2.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.13.113.180
country_id: 3865483
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/banner4.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.141.192
country_id: 587116
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/portfolio/insect_bites.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.208.243.180
country_id: 3469034
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/banner1.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.180.222.34
country_id: 99237
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/waze.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.60.130
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.110.193
country_id: 798544
description:
Jan 13 19:41:07 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.110.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.199
country_id: 3175395
description:
Jan 13 19:41:10 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.110.193
country_id: 798544
description:
Jan 13 19:41:14 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.110.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.97
country_id: 3175395
description:
Jan 13 19:41:53 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.97 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.123
country_id: 2077456
domain: acburn.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:acburnco||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.106
country_id: 2077456
domain: indfinitydesign.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:indfinitydesign||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.1.219.125
country_id: 3865483
description:
Jan 13 19:41:09 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.1.219.125 has been locked due to Imunify RBL


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 111.225.148.36
country_id: 1814991
domain: www.box.com.my
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.123
country_id: 2077456
domain: ajplantations.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:ajpl3424||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 19:42:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58015: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.190.115.191
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=735818 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.126
country_id: 2077456
domain: ajresorts.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:ajresortscom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.123
country_id: 2077456
domain: nmahir.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:nmahirc||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.99.20
country_id: 3996063
description:
Jan 13 19:41:28 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.99.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.114
country_id: 2077456
domain: urban.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:urban||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.116
country_id: 2077456
domain: mkmetal.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:mkmetalc||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.165.176
country_id: 3469034
description:
Jan 13 19:41:46 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.165.176 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.153
country_id: 2077456
domain: smartcable.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:smartcable||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.124
country_id: 2077456
domain: aircarbonic.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:aircarbonicadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.116
country_id: 2077456
domain: symphony-led.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:symphonyadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.122
country_id: 2077456
domain: lnlfireprotection.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:lnlfireprotectio||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.136
country_id: 2077456
domain: pspoly.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:pspolycom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 19:42:12 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58015: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.107
country_id: 2077456
domain: modern.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:modern||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.120
country_id: 2077456
domain: ms-chemicals.net
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:mschemic||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/demos/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.144
country_id: 2077456
domain: eminent.st
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:eminent||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.148
country_id: 2077456
domain: vtgroupsb.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:vtgroupsb||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.149
country_id: 2077456
domain: langkawiconstructions.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:lkwconstructions||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.160
country_id: 2077456
domain: imax.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:imaxcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.125
country_id: 2077456
domain: empirelog.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:empi7862||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.128
country_id: 2077456
domain: stillman.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:stillman||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.139
country_id: 2077456
domain: box.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:woh||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.118
country_id: 2077456
domain: sutsb.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:sutsbcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.137
country_id: 2077456
domain: stonewld.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:stonewld||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.154
country_id: 2077456
domain: mokshana.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:mokshanacom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.124
country_id: 2077456
domain: aire-fresh.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:airefresh||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.135
country_id: 2077456
domain: evergrown.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:evergrown||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.110
country_id: 2077456
domain: agpc.org.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:agpcorg||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.113
country_id: 2077456
domain: agsaintifik.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:agsaintifik||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.115
country_id: 2077456
domain: egbwawasan.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:egbwawasancom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.140
country_id: 2077456
domain: nexuscollection.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:nexus2019||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.151
country_id: 2077456
domain: af-sb.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:afsb||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.109
country_id: 2077456
domain: rcct.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:rcct||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.137
country_id: 2077456
domain: myfurnitureshop.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:myfurnit||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.149
country_id: 2077456
domain: ahfengineering.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:ahfe3522||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.124
country_id: 2077456
domain: www.inter-link.edu.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:interlink||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.110
country_id: 2077456
domain: fkr.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:fkrcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.128
country_id: 2077456
domain: fimco.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:fimco||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.161
country_id: 2077456
domain: chs.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:chscommy||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.117
country_id: 2077456
domain: masaakisb.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:masaakisb||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.138
country_id: 2077456
domain: saps.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:sapscom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.118
country_id: 2077456
domain: cordage.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:admincordage||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.122
country_id: 2077456
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:pftfood||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.154
country_id: 2077456
domain: manforce.net
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:manfotp3||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.149
country_id: 2077456
domain: feliogroup.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:feliogroupcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.115
country_id: 2077456
domain: tst-ma.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:tstmacom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.113
country_id: 2077456
domain: advisorygroup.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:advi3535||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.112
country_id: 2077456
domain: lvconsult.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:lvconsultcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.138
country_id: 2077456
domain: aoto.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:aotocom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.131
country_id: 2077456
domain: hmz.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:hmzcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.137
country_id: 2077456
domain: autogreastar.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:autogrea||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.145
country_id: 2077456
domain: oxbold.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:oxboldc||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.149
country_id: 2077456
domain: vmsmotorsports.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:vmsadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.123
country_id: 2077456
domain: garudabay.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:garudabay||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.107
country_id: 2077456
domain: jpack.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:jpackcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.141
country_id: 2077456
domain: achieversvisionacademy.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:achieversvisiona||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.122
country_id: 2077456
domain: nobledec.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:nobledec||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.134
country_id: 2077456
domain: astlog.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:astlogc||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.113
country_id: 2077456
domain: visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:visoftcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.145
country_id: 2077456
domain: tujusetia.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:tuju7822||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.130
country_id: 2077456
domain: mckd.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:mckd||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.130
country_id: 2077456
domain: webhosting2u.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:webhost||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.115
country_id: 2077456
domain: euratech.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:euratechcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.116.101
country_id: 3469034
description:
Jan 13 19:47:23 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.116.101 has been locked due to Imunify RBL


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.145.240.127
country_id: 6252001
domain: mail.printspecsolution.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.63||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.35
country_id: 3175395
description:
Jan 13 19:50:36 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.208.171
country_id: 798544
description:
Jan 13 19:50:54 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.208.171 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.96.246.66
country_id: 290557
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603677 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.48.70.30
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=144058 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.103.119.166
country_id: 1168579
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=25 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.228.38.220
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=553758 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.208.141.241
country_id: 2245662
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&page_id=1&sub=2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.47.40.68
country_id: 357994
description:
Jan 13 20:03:00 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.47.40.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.47.40.68
country_id: 357994
description:
2026-01-13 20:03:02 dovecot_plain authenticator failed for H=(unattengum) [197.47.40.68]:47548: 535 Incorrect authentication data (set_id=mail@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.142
country_id: 1269750
description:
Jan 13 20:03:12 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.45.167.104
country_id: 2510769
description:
Jan 13 20:03:41 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.45.167.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 20:03:59 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.193.153.67
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=515102 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.109
country_id: 2077456
domain: printspecsolution.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:printspecsolutio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.126
country_id: 2300660
description:
Jan 13 20:05:48 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.126 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.111
country_id: 2077456
domain: dsc-expat.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:dscexpat||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.127
country_id: 2077456
domain: maalloys.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:maalloyscom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.109
country_id: 2077456
domain: geminiflourmill.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:cabecom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.142
country_id: 2077456
domain: tschuan.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:tschuan||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.144
country_id: 2077456
domain: cofreth.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:cofrethcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.122
country_id: 2077456
domain: gagasanteguh.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:gagasanteguhcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.109
country_id: 2077456
domain: dps-comsec.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:dpscomsec||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.115
country_id: 2077456
domain: kimmark.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:kimmark||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.129
country_id: 2077456
domain: dynamic-hr.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:dynamichrcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.141
country_id: 2077456
domain: kendek.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:kendek||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.125
country_id: 2077456
domain: kdiballoon.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:kdiballo1||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.114
country_id: 2077456
domain: vc-b.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:vcbcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.133
country_id: 2077456
domain: ds-staffing.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:dsstaffing||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.125
country_id: 2077456
domain: solidfence.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:solidfencecom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.106
country_id: 2077456
domain: krisfood.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:krisfood||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.227
country_id: 130758
description:
2026-01-13 20:06:42 H=([62.60.130.227]) [62.60.130.227]:53277 F=<noreply@apix.fi> rejected RCPT <prayerlink@agpc.org.my>: SPF: 62.60.130.227 is not allowed to send mail from apix.fi


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 20:07:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60474: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 20:07:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60474: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.91
country_id: 3865483
description:
Jan 13 20:07:33 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/news.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 69.160.160.55
country_id: 6252001
domain: fkr.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/81.0.4044.92 Safari/537.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 20:08:31 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.72.193.120
country_id: 1643084
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&page_id=3 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/apm/images/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 20:10:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58118: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 20:10:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58118: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.216
country_id: 3175395
description:
Jan 13 20:12:21 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.216 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.191.139.92
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=486189 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.1.175.182
country_id: 3686110
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=20 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
country_id: 1814991
description:
Jan 13 20:14:38 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2026-01-13 20:14:40 dovecot_login authenticator failed for H=([218.22.187.70]) [218.22.187.66]:49058: 535 Incorrect authentication data (set_id=wgoeqsscr@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.17.126
country_id: 798549
description:
2026-01-13 20:18:08 dovecot_plain authenticator failed for H=(no-rdns.mivocloud.com) [185.225.17.126]:35412: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.17.126
country_id: 798549
description:
2026-01-13 20:18:13 dovecot_plain authenticator failed for H=(no-rdns.mivocloud.com) [185.225.17.126]:35426: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/eco.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.133
country_id: 2510769
description:
Jan 13 20:19:12 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.133 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 188.126.94.74
country_id: 2623032
domain: box.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.242
country_id: 3175395
description:
Jan 13 20:19:32 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-13 20:20:54 H=([77.83.39.92]) [77.83.39.92]:52173 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <jaya@ktlog.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.48.223.159
country_id: 1733045
description:
2026-01-13 20:21:19 H=([192.168.68.103]) [60.48.223.159]:51157 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<vasundra@egbwawasan.com.my> A=dovecot_login:vasundra@egbwawasan.com.my temporarily rejected RCPT <SweatLing.Kor@kerrylogistics.com>: host lookup did not complete


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.63.132.252
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=541552 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.109.99.59
country_id: 660013
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-22.65.109.99.59||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/news.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.189.184.17
country_id: 1227603
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=449403 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/demos/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.75.160.21
country_id: 2542007
description:
2026-01-13 20:27:46 dovecot_plain authenticator failed for H=([192.168.1.8]) [196.75.160.21]:58608: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-01-13 20:30:30 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:49317: 535 Incorrect authentication data (set_id=jobs@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.75.160.21
country_id: 2542007
description:
2026-01-13 20:31:08 dovecot_plain authenticator failed for H=([192.168.1.8]) [196.75.160.21]:57819: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.129.245.249
country_id: 1814991
description:
Jan 13 20:30:28 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.129.245.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.75.160.21
country_id: 2542007
description:
2026-01-13 20:31:12 dovecot_plain authenticator failed for H=([192.168.1.8]) [196.75.160.21]:57823: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 196.75.160.21
country_id: 2542007
description:
2026-01-13 20:31:19 dovecot_login authenticator failed for H=([192.168.1.8]) [196.75.160.21]:58591: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.193.26.55
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=708804 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.179.38.132
country_id: 2017370
description:
2026-01-13 20:34:42 dovecot_plain authenticator failed for H=(diple) [82.179.38.132]:33047: 535 Incorrect authentication data (set_id=support@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 20:35:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60505: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 20:35:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60506: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.235.54.243
country_id: 357994
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=227277 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.15.6
country_id: 1149361
description:
Jan 13 20:38:00 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.15.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.6
country_id: 1149361
description:
2026-01-13 20:38:02 dovecot_login authenticator failed for H=([149.54.15.6]) [149.54.15.6]:42843: 535 Incorrect authentication data (set_id=ratanam@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 20:38:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58196: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.73.51.218
country_id: 1814991
description:
Jan 13 20:38:23 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.73.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.73.51.218
country_id: 1814991
description:
2026-01-13 20:38:25 dovecot_login authenticator failed for H=([222.73.51.218]) [222.73.51.218]:40480: 535 Incorrect authentication data (set_id=salesmp@aoto.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 20:38:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58196: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.97
country_id: 798544
description:
Jan 13 20:39:26 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.160
country_id: 3469034
description:
Jan 13 20:39:29 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.160 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.150.246.136
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=954784 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.186.98
country_id: 6252001
description:
[2026-01-13 20:41:32 +0800] info [cpaneld] 136.227.186.98 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.238
country_id: 3865483
description:
Jan 13 20:41:39 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 151.240.205.206
country_id: 6252001
domain: aoto.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/89.0.4389.90 Safari/537.36||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.177.208.54
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=611667 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/services.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.124.249.36
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=263428 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-13 20:44:10 H=([77.83.39.92]) [77.83.39.92]:61020 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <stacy@ktlog.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/iso.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.221
country_id: 3865483
description:
Jan 13 20:45:54 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.53
country_id: 690791
description:
Jan 13 20:45:33 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.53 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.203.142.115
country_id: 690791
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/mockery/mockery/tests/Bootstrap.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.221
country_id: 3865483
description:
Jan 13 20:46:09 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.179.38.132
country_id: 2017370
description:
Jan 13 20:47:36 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.179.38.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.179.38.132
country_id: 2017370
description:
2026-01-13 20:47:38 dovecot_plain authenticator failed for H=(ortal) [82.179.38.132]:38116: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 64.49.36.17
country_id: 6252001
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /contact.php?companyaddress=Hi Team,\r\n\r\nI spotted your site is stuck on Page 2 of Google for your main keywords.\r\n\r\nHonestly, your site looks better than the competitors ranking #1, yet they are getting the market share. You are essentially donating leads to them for free because of hidden technical issues.\r\n\r\nI have generated a comparison report pinpointing how to fix this.\r\n\r\nReply with \"yes\" and I'll send it over.\r\n\r\nCheers,\r\nP Media Partners&message=Hi Team,\r\n\r\nI spotted your website is hanging on the second page of Google for high-traffic search terms.\r\n\r\nFrankly, your site looks superior than the guys at the top, yet they are getting all the traffic. You are essentially donating customers to them on a silver platter due to hidden technical issues.\r\n\r\nI have generated a competitor analysis showing exactly how to beat them.\r\n\r\nSimply reply \"yes\" and I'll email it to you.\r\n\r\nRegards,\r\nP Media Partners HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.180.101.144
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=186475 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 157.230.43.225
country_id: 1880251
domain: inter-link.edu.my
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:-d allow_url_include=on -d auto_prepend_file=php://input||MVN:MATCHED_VAR||WPU:||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/demos/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.50.204.222
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=731605 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.73.218
country_id: 1269750
description:
Jan 13 20:54:45 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.73.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-13 20:56:15 H=([185.214.10.21]) [185.214.10.21]:54215 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info@mkmetal.com.my> rejected RCPT <info@mkmetal.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.183.119
country_id: 3865483
description:
Jan 13 20:57:49 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.183.119 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.95.2.65
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=678166 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.98
country_id: 226074
description:
Jan 13 20:57:27 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.98 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 14.192.213.164
country_id: 1733045
description:
[2026-01-13 20:59:40 +0800] info [webmaild] 14.192.213.164 - jefflee@sutsb.com.my "POST /cpsess1641748787/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [60.53.110.66] != Current IP Address [14.192.213.164]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.45.92.59
country_id: 2589581
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=11 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.127.33.159
country_id: 3469034
description:
Jan 13 21:01:03 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.127.33.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.119.182.79
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-01.92.119.182.79||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.127.33.159
country_id: 3469034
description:
Jan 13 21:01:11 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.127.33.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 21:03:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60527: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 21:03:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60527: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 196.251.100.206
country_id: 241170
description:
2026-01-13 21:05:45 2544608 [Warning] Aborted connection 2544608 to db: 'unconnected' user: 'unauthenticated' host: '196.251.100.206' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.173.18.250
country_id: 1814991
description:
Jan 13 21:06:37 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.173.18.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.173.18.250
country_id: 1814991
description:
2026-01-13 21:06:39 dovecot_login authenticator failed for H=([117.173.18.250]) [117.173.18.250]:59096: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 196.251.100.206
country_id: 241170
description:
2026-01-13 21:07:41 2544707 [Warning] Aborted connection 2544707 to db: 'unconnected' user: 'unauthenticated' host: '196.251.100.206' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.162
country_id: 798544
description:
Jan 13 21:10:35 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.162 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.151.213.39
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=778095 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.106.50
country_id: 3175395
description:
Jan 13 21:11:37 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.106.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.79.22.130
country_id: 1562822
description:
Jan 13 21:14:48 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.79.22.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.79.22.130
country_id: 1562822
description:
2026-01-13 21:14:50 dovecot_login authenticator failed for H=([27.79.22.130]) [27.79.22.130]:61538: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.187
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/monthlyletter/images/events.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.171
country_id: 6290252
description:
Jan 13 21:17:26 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.16.186
country_id: 2300660
description:
Jan 13 21:18:00 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.16.186 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.155.137.122
country_id: 163843
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/debug/Tests/phpt/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.194.78.174
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=448567 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.65.157.95
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=940563 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.16.186
country_id: 2300660
description:
Jan 13 21:18:14 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.16.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.235
country_id: 298795
description:
Jan 13 21:18:25 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.235 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.3.130
country_id: 1168579
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/debug/Tests/phpt HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.62.73.218
country_id: 1835841
description:
2026-01-13 21:19:26 dovecot_login authenticator failed for H=([211.62.73.218]) [211.62.73.218]:52946: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.141.6
country_id: 3469034
description:
Jan 13 21:20:01 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.141.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.62.73.218
country_id: 1835841
description:
Jan 13 21:19:24 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.62.73.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.12.160
country_id: 2300660
description:
Jan 13 21:20:31 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.12.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.203
country_id: 3175395
description:
Jan 13 21:20:52 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.141.6
country_id: 3469034
description:
Jan 13 21:20:09 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.141.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.98.213.252
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=174516 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.152.79.105
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=634412 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.184.252.93
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=8 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.83.2.183
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=457703 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.147.107.117
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=470762 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.51.26.198
country_id: 1269750
description:
Jan 13 21:27:58 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.51.26.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-01-13 21:28:00 dovecot_login authenticator failed for H=(103.51.26.198.sukaininfoway.com) [103.51.26.198]:45548: 535 Incorrect authentication data (set_id=accounting@maalloys.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.116.165.52
country_id: 6290252
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/products.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.116.165.52
country_id: 6290252
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/products.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 21:31:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60549: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 21:31:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60549: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.227
country_id: 953987
description:
Jan 13 21:31:41 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.227 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 196.251.100.206
country_id: 241170
description:
2026-01-13 21:31:52 2545786 [Warning] Aborted connection 2545786 to db: 'unconnected' user: 'unauthenticated' host: '196.251.100.206' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.136.66
country_id: 690791
description:
Jan 13 21:33:05 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.136.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.45.41.34
country_id: 2589581
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&sub=4 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.136.66
country_id: 690791
description:
Jan 13 21:33:12 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.136.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.192.212.214
country_id: 1733045
domain: www.mokshana.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mokshana.com.my/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.115.67.169
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/guzzlehttp/psr7/src/MultipartStream.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/img/private-residence.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.140.114
country_id: 732800
description:
Jan 13 21:35:23 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.140.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.33.198
country_id: 226074
description:
Jan 13 21:35:29 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.33.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.39
country_id: 3865483
description:
Jan 13 21:36:03 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.39
country_id: 3865483
description:
Jan 13 21:36:12 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.88.8.36
country_id: 1168579
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=30 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.181.2.130
country_id: 2017370
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=982714 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 116.90.73.12
country_id: 2077456
domain: mkmetal.com.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.63||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.211.217.127
country_id: 3658394
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=626921 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.164.224.31
country_id: 587116
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=277285 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.79.129.119
country_id: 1562822
description:
Jan 13 21:43:20 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.79.129.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.79.129.119
country_id: 1562822
description:
2026-01-13 21:43:22 dovecot_login authenticator failed for H=([127.0.0.1]) [27.79.129.119]:38271: 535 Incorrect authentication data (set_id=office@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.66.107
country_id: 1512440
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/video.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.180
country_id: 798544
description:
Jan 13 21:46:26 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.232.64.53
country_id: 3469034
description:
Jan 13 21:46:35 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.232.64.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.39.212.79
country_id: 2510769
description:
Jan 13 21:46:55 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.39.212.79 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.166.101.252
country_id: 1282988
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=359598 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.43.90
country_id: 953987
description:
Jan 13 21:47:22 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.43.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/keyword/img/druma_photos/press.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.233.136.215
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=302004 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 16.146.86.169
country_id: 6252001
domain: www.modern.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/68.0.3440.106 Safari/537.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.110.162
country_id: 798544
description:
Jan 13 21:49:40 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.110.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.6.19
country_id: 2300660
description:
Jan 13 21:50:17 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.6.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/keyword/img/druma_photos/awards.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.101.179.219
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=975297 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 21:56:19 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.62.57.139
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/index.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 21:59:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60574: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 21:59:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60574: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 22:00:52 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.155.75
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=558493 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.121.185.116
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=641998 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.86.71
country_id: 1512440
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=5 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.197.150.37
country_id: 3057568
description:
2026-01-13 22:06:38 dovecot_login authenticator failed for H=static-dsl-37.87-197-150.telecom.sk [87.197.150.37]:47156: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.76.238.62
country_id: 690791
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=670535 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 13 22:07:37 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-13 22:07:39 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:32633: 535 Incorrect authentication data (set_id=finance@urban.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 217.160.74.128
country_id: 2921044
description:
Jan 13 22:07:35 sv3 pure-ftpd[1050149]: (?@217.160.74.128) [INFO] New connection from 217.160.74.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.53.57
country_id: 953987
description:
Jan 13 22:08:49 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.53.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.98.119.63
country_id: 798544
description:
Jan 13 22:08:56 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.98.119.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.98.119.63
country_id: 798544
description:
Jan 13 22:09:09 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.98.119.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.27
country_id: 798544
description:
Jan 13 22:09:22 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.151
country_id: 1269750
description:
Jan 13 22:09:48 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.151
country_id: 1269750
description:
2026-01-13 22:09:50 dovecot_login authenticator failed for H=([122.187.229.151]) [122.187.229.151]:56713: 535 Incorrect authentication data (set_id=finance@maalloys.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.203
country_id: 3469034
description:
Jan 13 22:10:12 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.30.79
country_id: 933860
description:
Jan 13 22:11:23 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.30.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-13 22:13:00 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (denistming) [87.103.126.54]:60770: 535 Incorrect authentication data (set_id=tom.cheong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 13 22:12:58 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 13 22:13:13 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-13 22:13:15 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (sanistocy) [87.103.126.54]:63073: 535 Incorrect authentication data (set_id=irene.wong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.153.110
country_id: 290557
description:
Jan 13 22:14:02 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.153.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-01-13 22:14:04 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:40584: 535 Incorrect authentication data (set_id=finance@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.73.196.243
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=749224 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.124.110.18
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=758571 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 13 22:16:13 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-13 22:16:15 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (plity) [87.103.126.54]:29273: 535 Incorrect authentication data (set_id=kimting.yap@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.64.133.161
country_id: 2017370
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/guzzlehttp/psr7/src/Stream.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.28.117.27
country_id: 453733
description:
Jan 13 22:19:49 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.28.117.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.230
country_id: 3469034
description:
Jan 13 22:21:10 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.11.138
country_id: 226074
description:
Jan 13 22:21:44 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.11.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.157
country_id: 3469034
description:
Jan 13 22:21:55 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.157
country_id: 3469034
description:
Jan 13 22:22:11 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.157 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.253.97.235
country_id: 3144096
description:
Jan 13 22:22:24 sv3 pure-ftpd[1058988]: (?@185.253.97.235) [INFO] New connection from 185.253.97.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.199
country_id: 1269750
description:
Jan 13 22:22:26 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 13 22:22:43 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-13 22:22:45 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (lercha) [87.103.126.54]:58620: 535 Incorrect authentication data (set_id=marketing@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.97
country_id: 3996063
description:
Jan 13 22:25:13 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.8.118.33
country_id: 1269750
description:
Jan 13 22:25:32 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.8.118.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 18.221.214.151
country_id: 6252001
description:
Jan 13 22:26:30 sv3 pure-ftpd[1061888]: (?@18.221.214.151) [INFO] New connection from 18.221.214.151


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.241.56.251
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/clients.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 22:27:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60595: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 22:27:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60595: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.104.28.42
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=1&sub=20 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/img/photos/images/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.145.126
country_id: 1819730
description:
Jan 13 22:32:31 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.145.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-01-13 22:32:33 dovecot_login authenticator failed for H=([223.197.145.126]) [223.197.145.126]:61364: 535 Incorrect authentication data (set_id=contact@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
country_id: 1835841
description:
Jan 13 22:33:26 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-13 22:33:28 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:35992: 535 Incorrect authentication data (set_id=contact@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.248
country_id: 3175395
description:
Jan 13 22:33:44 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.248 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/es/img/photos/article.php||SC:/home/indfinitydesign/public_html/es||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.143
country_id: 3469034
description:
Jan 13 22:33:23 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.143 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.255.21.117
country_id: 2017370
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=936837 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.26
country_id: 3175395
description:
Jan 13 22:34:13 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 13 22:35:33 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-13 22:35:35 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (ativolater) [87.103.126.54]:36037: 535 Incorrect authentication data (set_id=info@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.99
country_id: 3469034
description:
Jan 13 22:35:29 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.87.249.76
country_id: 798544
description:
Jan 13 22:39:53 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.87.249.76 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.37.141.65
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=685978 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.81.164
country_id: 337996
description:
2026-01-13 22:40:28 dovecot_plain authenticator failed for H=(6MB1PQ8V7O8RZW8) [196.188.81.164]:56501: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.174.211.42
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=951091 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.227.185.47
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&sub=2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.98.10.70
country_id: 2589581
description:
2026-01-13 22:42:43 dovecot_plain authenticator failed for H=(LE7AQH53ZALJ4) [41.98.10.70]:58902: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.213.28.28
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-43.216.213.28.28||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.135.9
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/checkout.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.243.6.2
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=680282 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.55.102.85
country_id: 3469034
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/news.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.20.67.98
country_id: 783754
description:
Jan 13 22:44:10 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.20.67.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.168.241.57
country_id: 798544
description:
Jan 13 22:44:28 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.168.241.57 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.89.133
country_id: 99237
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=44 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.121.182.225
country_id: 3437598
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/corporate.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.109.114.242
country_id: 3469034
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/product-category.php?id=5 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.50.77.37
country_id: 290557
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/about_us.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.54.190.75
country_id: 3439705
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/organizational.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.145.81
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/contect.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.166.86.228
country_id: 2017370
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/cart.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.4.30.209
country_id: 3469034
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/single-service.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.172.165.155
country_id: 3625428
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-86.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.238.34.111
country_id: 3625428
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=739548 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.80.92.92
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/console/Exception/InvalidArgumentException.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 50.4.34.176
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/build/17/334/1715811 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.47
country_id: 798544
description:
Jan 13 22:51:26 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.47 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.155.18.237
country_id: 3686110
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?route=product/search&tag=a011-0112 - rsc plain carton HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 22:55:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60613: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 22:55:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60614: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.12
country_id: 3469034
description:
Jan 13 22:55:52 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.153.127.251
country_id: 3625428
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/facilities.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.16.188.5
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=600737 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.66
country_id: 3469034
description:
Jan 13 23:03:56 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.66
country_id: 3469034
description:
Jan 13 23:04:11 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.177.208.117
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=841603 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.106.241.90
country_id: 2017370
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=872055 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.89.205.24
country_id: 1605651
description:
Jan 13 23:07:07 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.89.205.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.183.186.238
country_id: 2510769
description:
Jan 13 23:06:22 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.183.186.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.205.24
country_id: 1605651
description:
2026-01-13 23:07:09 dovecot_login authenticator failed for H=mx-ll-183.89.205-24.dynamic.3bb.co.th ([127.0.0.1]) [183.89.205.24]:37742: 535 Incorrect authentication data (set_id=inf@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.223.2.42
country_id: 1269750
description:
Jan 13 23:08:10 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.223.2.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.17
country_id: 2510769
description:
Jan 13 23:08:58 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.122
country_id: 3469034
description:
Jan 13 23:09:03 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.0.124.60
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=983961 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.29.231.106
country_id: 1814991
description:
2026-01-13 23:09:10 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [218.29.231.106]:57643: 535 Incorrect authentication data (set_id=purchasing3@ocned.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.17
country_id: 2510769
description:
Jan 13 23:09:11 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.122
country_id: 3469034
description:
Jan 13 23:09:12 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.63.96.72
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=768301 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.235.123
country_id: 3865483
description:
Jan 13 23:11:00 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.235.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.235.123
country_id: 3865483
description:
Jan 13 23:11:14 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.235.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.119
country_id: 798544
description:
Jan 13 23:11:21 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.119 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.150.250.139
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=942320 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/images/news.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.139.191
country_id: 99237
description:
Jan 13 23:12:08 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.139.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.87.105.184
country_id: 1269750
description:
Jan 13 23:12:27 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.87.105.184 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.72.223.93
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=595675 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.224.223.115
country_id: 3865483
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-63.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/img/photos/images/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.0.121.147
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&page_id=1&sub=33 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.104.125
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-60.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 137.255.28.103
country_id: 2395170
description:
2026-01-13 23:15:35 H=([137.255.28.103]) [137.255.28.103]:27907 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 137.255.28.103
country_id: 2395170
description:
2026-01-13 23:17:05 H=([137.255.28.103]) [137.255.28.103]:28265 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.0.105.71
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=126580 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.122
country_id: 690791
description:
Jan 13 23:17:43 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 137.255.28.103
country_id: 2395170
description:
2026-01-13 23:18:09 H=([137.255.28.103]) [137.255.28.103]:28603 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 137.255.28.103
country_id: 2395170
description:
2026-01-13 23:18:51 H=([137.255.28.103]) [137.255.28.103]:28659 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.33.126.204
country_id: 953987
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/7352662933.jpg&size=1000x1000 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.62.114
country_id: 1149361
description:
Jan 13 23:19:36 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.62.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.114
country_id: 1149361
description:
2026-01-13 23:19:38 dovecot_login authenticator failed for H=([149.54.62.114]) [149.54.62.114]:46949: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2026-01-13 23:21:38 dovecot_login authenticator failed for H=(aes-static-177.143.22.125.airtel.in) [128.185.239.182]:39138: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.5.109.4
country_id: 2017370
description:
2026-01-13 23:21:13 dovecot_plain authenticator failed for H=(condelubs) [213.5.109.4]:42056: 535 Incorrect authentication data (set_id=chuanyee.ang@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.239.182
country_id: 1269750
description:
Jan 13 23:21:36 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.239.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.84.173.1
country_id: 3437598
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=784798 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.218.95.154
country_id: 6252001
description:
Jan 13 23:22:22 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.218.95.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-13 23:22:24 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:53037: 535 Incorrect authentication data (set_id=feedback@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 23:23:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60636: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 23:23:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60637: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.214.4
country_id: 798544
description:
Jan 13 23:24:09 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.214.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.227.16.83
country_id: 3469034
description:
Jan 13 23:25:07 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.227.16.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.227.16.83
country_id: 3469034
description:
Jan 13 23:25:15 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.227.16.83 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.50
country_id: 6252001
description:
2026-01-13 23:26:18 2550168 [Warning] Aborted connection 2550168 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.50' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-13 23:27:23 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:57961: 535 Incorrect authentication data (set_id=feedback@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.218.95.154
country_id: 6252001
description:
Jan 13 23:27:21 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.218.95.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 154.36.110.152
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-29.154.36.110.152||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.175.210.175
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-29.107.175.210.175||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.100.86.249
country_id: 732800
description:
Jan 13 23:32:05 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.100.86.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.100.86.249
country_id: 732800
description:
Jan 13 23:32:12 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.100.86.249 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.129.29
country_id: 1168579
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=975825 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.39.99.106
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=138029 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.38
country_id: 6252001
description:
2026-01-13 23:33:11 2550426 [Warning] Aborted connection 2550426 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.38' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.232.162
country_id: 1835841
domain: aircarbonic.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/aircarbonicadmin/public_html/wp-admin||


plugin: modsec
rule: 77140740
name: IM360 WAF: Twenty shell abuse attempt
abuser: 4.217.232.162
country_id: 1835841
domain: aircarbonic.my
description:
IM360 WAF: Twenty shell abuse attempt||MVN:REQUEST_HEADERS:Referer||WPU:||RSV:7.63||T:APACHE||MV:https://www.yahoo.com/||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 223.228.149.146
country_id: 1269750
description:
2026-01-13 23:35:56 H=([117.197.83.45]) [223.228.149.146]:10834 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.184.226.185
country_id: 3865483
description:
Jan 13 23:36:11 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.184.226.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.196
country_id: 298795
description:
Jan 13 23:36:34 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 223.228.149.146
country_id: 1269750
description:
2026-01-13 23:36:37 H=([117.197.83.45]) [223.228.149.146]:11068 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.174
country_id: 3469034
description:
Jan 13 23:37:20 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.174 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.26.147
country_id: 798544
description:
Jan 13 23:37:42 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.26.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.58.165.186
country_id: 3439705
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=513447 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.131.178.34
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/07reader.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140740
name: IM360 WAF: Twenty shell abuse attempt
abuser: 4.217.232.162
country_id: 1835841
domain: astlog.com.my
description:
IM360 WAF: Twenty shell abuse attempt||MVN:REQUEST_HEADERS:Referer||WPU:||RSV:7.63||T:APACHE||MV:https://duckduckgo.com/||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.26.10.85
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-33.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.232.162
country_id: 1835841
domain: astlog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/astlogc/public_html/wp-admin/images/admin.php||


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jan 13 23:42:03 sv3 dovecot[1115219]: master: Dovecot v2.4.2 (0962ed2104) starting up for lmtp, imap, pop3, sieve


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.90.98.241
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product-detail.php?id=7742162736 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.204.208.171
country_id: 2017370
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/carry/12/669/1267736 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.173.177.133
country_id: 6252001
description:
Jan 13 23:44:40 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.173.177.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.173.177.133
country_id: 6252001
description:
2026-01-13 23:44:42 dovecot_login authenticator failed for H=(emcbz) [107.173.177.133]:50670: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.237.188.208
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=501726 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.96.89.124
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-48.172.96.89.124||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 23:48:39 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.202.100
country_id: 953987
description:
Jan 13 23:50:16 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.202.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 23:51:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60659: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 23:51:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60659: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.190.14.165
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=168924 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/druma/index.php||SC:/home/indfinitydesign/public_html/images/druma||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.254.202.207
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=568838 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.215.133
country_id: 933860
description:
Jan 13 23:53:18 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.215.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 23:53:13 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-13 23:56:29 H=([45.144.212.54]) [45.144.212.54]:63910 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <azman@ajplantations.com.my>: No Such User Here"


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/osl.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-14 00:00:18 H=([45.144.212.54]) [45.144.212.54]:50576 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <azman@ajplantations.com.my>: No Such User Here"


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.186.76.5
country_id: 1168579
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-26.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.153.19.131
country_id: 2510769
description:
Jan 14 00:05:12 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.153.19.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.208.85
country_id: 798544
description:
Jan 14 00:05:30 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.208.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.179.38.132
country_id: 2017370
description:
Jan 14 00:07:46 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.179.38.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.179.38.132
country_id: 2017370
description:
2026-01-14 00:07:48 dovecot_plain authenticator failed for H=(eciang) [82.179.38.132]:59475: 535 Incorrect authentication data (set_id=cheehian.ooi@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
country_id: 1835841
description:
Jan 14 00:08:30 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-01-14 00:08:32 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:40364: 535 Incorrect authentication data (set_id=help@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.47.190
country_id: 99237
description:
Jan 14 00:09:55 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.47.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2026-01-14 00:09:57 dovecot_login authenticator failed for H=([185.255.47.190]) [185.255.47.190]:48492: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.139.220
country_id: 1880251
domain: www.appointment.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/mockery/mockery/docs/getting_started/map.rst.inc||User:visoftcom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.0.233.116
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/recycling.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
country_id: 1835841
description:
Jan 14 00:11:55 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-01-14 00:11:57 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:49912: 535 Incorrect authentication data (set_id=help@maalloys.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.68
country_id: 2395170
description:
Jan 14 00:12:07 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.172.106.105
country_id: 1814991
description:
Jan 14 00:11:09 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.172.106.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.172.106.105
country_id: 1814991
description:
2026-01-14 00:11:11 dovecot_login authenticator failed for H=([117.172.106.105]) [117.172.106.105]:53794: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.203
country_id: 953987
description:
Jan 14 00:11:14 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.85
country_id: 798544
description:
Jan 14 00:11:22 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.48
country_id: 690791
description:
Jan 14 00:11:41 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.68
country_id: 2395170
description:
Jan 14 00:12:15 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.68 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.178.69.26
country_id: 3703430
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/always/669/697953 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.249
country_id: 3175395
description:
Jan 14 00:14:58 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.160.73
country_id: 3469034
description:
Jan 14 00:14:22 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.160.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.214.4
country_id: 798544
description:
Jan 14 00:15:36 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.214.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.12
country_id: 3469034
description:
Jan 14 00:15:36 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.232.223.6
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/training-details.php?id=491477 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.249
country_id: 3175395
description:
Jan 14 00:15:11 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 00:19:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60702: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 00:19:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60702: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.210.35.147
country_id: 390903
description:
Jan 14 00:20:02 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.210.35.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.50.0.111
country_id: 4566966
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/big/516/213045 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.35.147
country_id: 390903
description:
2026-01-14 00:20:04 dovecot_plain authenticator failed for H=(uness) [149.210.35.147]:59646: 535 Incorrect authentication data (set_id=webmaster@fkr.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.87.249.76
country_id: 798544
description:
Jan 14 00:20:45 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.87.249.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2026-01-14 00:23:25 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.104.50.190]:36970: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.32.41.16
country_id: 798549
description:
Jan 14 00:24:25 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.32.41.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.32.41.16
country_id: 798549
description:
2026-01-14 00:24:27 dovecot_login authenticator failed for H=(ADMIN) [89.32.41.16]:46086: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.142.184.55
country_id: 1210997
description:
Jan 14 00:26:33 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.142.184.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-01-14 00:26:35 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:38168: 535 Incorrect authentication data (set_id=salesmp@aoto.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.133.161
country_id: 3175395
description:
Jan 14 00:27:28 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.133.161 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 45.142.154.34
country_id: 1819730
description:
2026-01-14  0:28:02 1657 [Warning] Aborted connection 1657 to db: 'unconnected' user: 'unauthenticated' host: '45.142.154.34' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.89.164.226
country_id: 2635167
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/img/img/demos/img/index.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/apm/images/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.239.28
country_id: 3469034
description:
Jan 14 00:34:43 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.239.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.42.46.35
country_id: 4566966
description:
2026-01-14 00:34:49 dovecot_login authenticator failed for H=(solitude.engreensolutions.com.) [24.42.46.35]:39078: 535 Incorrect authentication data (set_id=rajanazrul@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.237
country_id: 3469034
description:
Jan 14 00:36:52 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.173
country_id: 2300660
description:
Jan 14 00:37:19 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.93.216.191
country_id: 1269750
description:
2026-01-14 00:38:06 dovecot_plain authenticator failed for H=(zyrthb4x0jz0dhbwio9s3) [59.93.216.191]:51066: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-14 00:38:15 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:41317: 535 Incorrect authentication data (set_id=press@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.159.187
country_id: 1733045
description:
Jan 14 00:38:41 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.159.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.187
country_id: 1733045
description:
2026-01-14 00:38:43 dovecot_login authenticator failed for H=([49.124.159.187]) [49.124.159.187]:51404: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.115.138.235
country_id: 617790
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/7018710133.jpg&size=1000x1000 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.94.52.223
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-41.23.94.52.223||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.20
country_id: 3469034
description:
Jan 14 00:42:52 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.216.40.166
country_id: 6290252
description:
Jan 14 00:43:07 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.216.40.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.216.40.166
country_id: 6290252
description:
Jan 14 00:43:14 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.216.40.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.111
country_id: 798544
description:
Jan 14 00:43:25 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.10.31.238
country_id: 719819
description:
Jan 14 00:44:11 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.10.31.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.86.166.102
country_id: 3469034
description:
Jan 14 00:45:01 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.86.166.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.86.166.102
country_id: 3469034
description:
Jan 14 00:45:09 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.86.166.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.225
country_id: 3865483
description:
Jan 14 00:46:17 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 00:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60723: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 00:47:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60723: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.198.20.189
country_id: 3996063
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/category/uncategorized HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.1.86
country_id: 798544
description:
Jan 14 00:49:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.1.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.203
country_id: 3469034
description:
Jan 14 00:49:40 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.237.82.103
country_id: 3469034
description:
Jan 14 00:50:34 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.237.82.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/apm/images/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.48
country_id: 798544
description:
Jan 14 00:57:16 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.27.203
country_id: 3469034
description:
Jan 14 01:05:43 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.27.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.115
country_id: 1269750
description:
Jan 14 01:06:05 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.127.99.184
country_id: 798549
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/intervention/image/src/config/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.255.86.174
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tyre_safety_tips_importance_correct_inflation.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.124.111.122
country_id: 2077456
description:
Jan 14 01:07:42 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.124.111.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-01-14 01:07:44 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net [27.124.111.122]:58189: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/rpl.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.189.36.4
country_id: 3469034
description:
[2026-01-14 01:10:42 +0800] info [cpaneld] 181.189.36.4 - kimmark "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.227
country_id: 3469034
description:
Jan 14 01:10:08 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.227 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.5.107.179
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=500196 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.178.196
country_id: 3175395
description:
Jan 14 01:10:30 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.178.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.19
country_id: 798544
description:
Jan 14 01:12:57 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.19
country_id: 798544
description:
Jan 14 01:13:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.245
country_id: 2510769
description:
Jan 14 01:13:44 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.152.26.169
country_id: 3469034
description:
Jan 14 01:14:04 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.152.26.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 01:15:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60751: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.152.26.169
country_id: 3469034
description:
Jan 14 01:14:12 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.152.26.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 01:15:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60752: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.150
country_id: 3865483
description:
Jan 14 01:16:59 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.165
country_id: 3865483
description:
Jan 14 01:16:35 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-14 01:17:38 dovecot_login authenticator failed for H=([144.121.245.65]) [64.72.74.162]:38812: 535 Incorrect authentication data (set_id=orders@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.228
country_id: 6290252
description:
Jan 14 01:17:12 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.141
country_id: 3175395
description:
Jan 14 01:17:30 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.29.241
country_id: 1835841
description:
2026-01-14 01:17:36 dovecot_login authenticator failed for H=([127.0.0.1]) [112.160.29.241]:56929: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.160.29.241
country_id: 1835841
description:
Jan 14 01:17:34 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.160.29.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Jan 14 01:17:36 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.103
country_id: 6252001
description:
2026-01-14  1:17:42 3463 [Warning] Aborted connection 3463 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.103' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.150
country_id: 3865483
description:
Jan 14 01:17:14 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.13.27.11
country_id: 1814991
description:
Jan 14 01:17:15 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.13.27.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.27.11
country_id: 1814991
description:
2026-01-14 01:17:17 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.27.11]:33089: 535 Incorrect authentication data (set_id=corporate@mssa.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.44.146.150
country_id: 1168579
domain: mail.uumism.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.uumism.edu.my/cgi-bin HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.165.217.77
country_id: 3865483
domain: mail.uumism.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.uumism.edu.my/cgi-bin/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Jan 14 01:20:19 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-14 01:20:21 dovecot_plain authenticator failed for H=(balatione) [64.72.74.162]:47469: 535 Incorrect authentication data (set_id=feiteen.gan@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
country_id: 2542007
description:
Jan 14 01:22:06 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-14 01:22:08 dovecot_plain authenticator failed for H=(undip) [102.53.15.18]:46476: 535 Incorrect authentication data (set_id=kimting.yap@tujusetia.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.71.107
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-22.142.111.71.107||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.44
country_id: 2017370
description:
2026-01-14 01:23:27 dovecot_login authenticator failed for H=([46.8.240.44]) [46.8.240.44]:38288: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.195.138.52
country_id: 6252001
description:
Jan 14 01:24:05 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.195.138.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.4.54
country_id: 1269750
description:
Jan 14 01:23:13 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.4.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.8.240.44
country_id: 2017370
description:
Jan 14 01:23:25 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.8.240.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.58.83.146
country_id: 3175395
description:
Jan 14 01:24:02 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.58.83.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.58.83.146
country_id: 3175395
description:
2026-01-14 01:24:04 dovecot_login authenticator failed for H=([101.58.83.146]) [101.58.83.146]:58655: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2026-01-14 01:24:07 dovecot_plain authenticator failed for H=c-98-195-138-52.hsd1.tx.comcast.net (congronval) [98.195.138.52]:44736: 535 Incorrect authentication data (set_id=shirley.wong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.234.11.10
country_id: 2017370
description:
Jan 14 01:24:21 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.234.11.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.11.10
country_id: 2017370
description:
2026-01-14 01:24:23 dovecot_login authenticator failed for H=([213.234.11.10]) [213.234.11.10]:59106: 535 Incorrect authentication data (set_id=nicholas@eminent.st)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.237.39.5
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=80411523583765 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.181.166
country_id: 1269750
description:
Jan 14 01:24:52 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.181.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-01-14 01:24:54 dovecot_login authenticator failed for H=(nsg-static-089.96.71.182.airtel.in) [182.95.181.166]:38820: 535 Incorrect authentication data (set_id=nicholas)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.40.64.155
country_id: 1269750
description:
Jan 14 01:26:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.40.64.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.46.7.146
country_id: 1522867
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=1&page_id=1&sub=35 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.218.228.187
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=758571 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.232.22.142
country_id: 3144096
description:
Jan 14 01:28:24 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.232.22.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.22.142
country_id: 3144096
description:
2026-01-14 01:28:26 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.22.142]:49873: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.154.214.12
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-28.192.154.214.12||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.170.162
country_id: 1269750
description:
Jan 14 01:28:12 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.170.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.170.162
country_id: 1269750
description:
2026-01-14 01:28:14 dovecot_login authenticator failed for H=([127.0.0.1]) [125.19.170.162]:49638: 535 Incorrect authentication data (set_id=info@pspoly.com.my)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 34.85.205.29
country_id: 6252001
description:
[2026-01-14 01:29:46 +0800] info [cpaneld] 34.85.205.29 - - "GET /site/wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Jan 14 01:29:30 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.85.205.29
country_id: 6252001
description:
[2026-01-14 01:29:42 +0800] info [cpaneld] 34.85.205.29 - - "GET /wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-14 01:29:32 dovecot_plain authenticator failed for H=(masunfal) [64.72.74.162]:35473: 535 Incorrect authentication data (set_id=admin@usfood.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.229.206
country_id: 1269750
description:
Jan 14 01:30:20 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.229.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.13.27.11
country_id: 1814991
description:
Jan 14 01:30:20 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.13.27.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.131.14.61
country_id: 2510769
description:
Jan 14 01:30:07 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.131.14.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.27.11
country_id: 1814991
description:
2026-01-14 01:30:22 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.27.11]:39739: 535 Incorrect authentication data (set_id=arts@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.206
country_id: 1269750
description:
2026-01-14 01:30:22 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.229.206]:39638: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-14 01:30:37 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:52285: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.213.218.254
country_id: 2635167
description:
Jan 14 01:30:58 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.213.218.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.213.218.254
country_id: 2635167
description:
2026-01-14 01:31:00 dovecot_login authenticator failed for H=([127.0.0.1]) [89.213.218.254]:39886: 535 Incorrect authentication data (set_id=arts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.131.14.61
country_id: 2510769
description:
2026-01-14 01:30:09 dovecot_login authenticator failed for H=([127.0.0.1]) [185.131.14.61]:57960: 535 Incorrect authentication data (set_id=no-reply@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.160.166.161
country_id: 1835841
description:
Jan 14 01:31:26 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.160.166.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2026-01-14 01:31:28 dovecot_login authenticator failed for H=([121.160.166.161]) [121.160.166.161]:54734: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.176.174.134
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-57.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.106
country_id: 6252001
description:
2026-01-14  1:32:09 3960 [Warning] Aborted connection 3960 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.106' (This connection closed normally without authentication)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 47.238.71.125
country_id: 1819730
domain: www.manforce.net
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/105.0.5195.19 Safari/537.36||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.230.25.156
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/ramsey/uuid/src/UuidInterface.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.178
country_id: 6252001
description:
Jan 14 01:33:52 sv3 pure-ftpd[1185959]: (?@205.210.31.178) [INFO] New connection from 205.210.31.178


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.141
country_id: 6252001
description:
Jan 14 01:35:14 sv3 pure-ftpd[1186932]: (?@198.235.24.141) [INFO] New connection from 198.235.24.141


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.32.113.39
country_id: 953987
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=541954 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.128.81.152
country_id: 285570
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&sub=26 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.239.196
country_id: 3469034
description:
Jan 14 01:37:33 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.239.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.65.142.65
country_id: 798544
description:
Jan 14 01:37:12 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.65.142.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-14 01:38:48 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:50935: 535 Incorrect authentication data (set_id=legal@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Jan 14 01:38:46 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.208.46.130
country_id: 1522867
description:
Jan 14 01:40:05 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.208.46.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 34.85.205.29
country_id: 6252001
description:
[2026-01-14 01:39:34 +0800] info [cpaneld] 34.85.205.29 - - "GET /site/wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
country_id: 2542007
description:
Jan 14 01:39:46 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-14 01:39:48 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:54982: 535 Incorrect authentication data (set_id=legal@nexuscollection.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.136.160.211
country_id: 3017382
description:
2026-01-14  1:40:01 4228 [Warning] Aborted connection 4228 to db: 'unconnected' user: 'unauthenticated' host: '185.136.160.211' (This connection closed normally without authentication)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.85.205.29
country_id: 6252001
description:
[2026-01-14 01:39:30 +0800] info [cpaneld] 34.85.205.29 - - "GET /wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.128.15
country_id: 732800
description:
Jan 14 01:39:51 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.128.15 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.239.151.10
country_id: 3932488
description:
Jan 14 01:39:58 sv3 pure-ftpd[1190181]: (?@185.239.151.10) [INFO] New connection from 185.239.151.10


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.239.151.35
country_id: 3932488
description:
Jan 14 01:40:00 sv3 pure-ftpd[1190196]: (?@185.239.151.35) [INFO] New connection from 185.239.151.35


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-14 01:40:07 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:53193: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.237.250.144
country_id: 192950
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/enquiry.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Jan 14 01:40:20 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-14 01:40:22 dovecot_plain authenticator failed for H=(manale) [64.72.74.162]:41276: 535 Incorrect authentication data (set_id=sales@kendek.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 01:40:58 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.7.16.75
country_id: 3932488
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/service.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.197
country_id: 2395170
description:
Jan 14 01:41:02 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.127.34.2
country_id: 3469034
description:
Jan 14 01:40:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.127.34.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.28.90.136
country_id: 3923057
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/resize.php?h=360&img=img/category_photos/59477378.jpg&w=360 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.208.55.100
country_id: 953987
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&page_id=2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.197
country_id: 2395170
description:
Jan 14 01:41:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 01:43:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60783: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.236
country_id: 3469034
description:
Jan 14 01:43:03 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.236 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/m.me/images/team.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.236
country_id: 3469034
description:
Jan 14 01:43:11 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 01:43:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60784: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.43
country_id: 3469034
description:
Jan 14 01:44:39 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.54
country_id: 3175395
description:
Jan 14 01:45:03 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 01:45:31 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.54
country_id: 3175395
description:
Jan 14 01:45:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.32
country_id: 3077311
description:
Jan 14 01:46:47 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 190.150.66.253
country_id: 3585968
description:
2026-01-14 01:48:45 H=([190.150.66.253]) [190.150.66.253]:43880 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 190.150.66.253
country_id: 3585968
description:
2026-01-14 01:49:27 H=([190.150.66.253]) [190.150.66.253]:63946 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 190.150.66.253
country_id: 3585968
description:
2026-01-14 01:50:09 H=([190.150.66.253]) [190.150.66.253]:65117 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 167.160.71.25
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-52.167.160.71.25||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.83.79.160
country_id: 1819730
domain: nobledec.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/assets/images/index.php||SC:/home2/nobledec/public_html/assets/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.123.229.23
country_id: 3703430
domain: www.usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.usfood.com.my/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.156
country_id: 3865483
description:
Jan 14 01:55:21 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.223
country_id: 3469034
description:
Jan 14 01:55:47 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.223 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.83.179.150
country_id: 3573591
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/country/19/122/1955397 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.171.79.194
country_id: 3686110
description:
Jan 14 01:57:21 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.171.79.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-14 02:00:54 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:43960: 535 Incorrect authentication data (set_id=dmca@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.17
country_id: 3175395
description:
Jan 14 02:03:04 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.6.19
country_id: 2300660
description:
Jan 14 02:03:02 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.6.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.177.100
country_id: 3469034
description:
Jan 14 02:03:55 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.177.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.6.19
country_id: 2300660
description:
Jan 14 02:03:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.6.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.17
country_id: 3175395
description:
Jan 14 02:03:11 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.74.237.1
country_id: 1562822
description:
2026-01-14 02:03:16 dovecot_login authenticator failed for H=([127.0.0.1]) [27.74.237.1]:60825: 535 Incorrect authentication data (set_id=info@pspoly.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.71.66.60
country_id: 3469034
description:
Jan 14 02:03:45 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.71.66.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.177.100
country_id: 3469034
description:
Jan 14 02:04:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.177.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.177
country_id: 2510769
description:
Jan 14 02:04:18 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.73.168.88
country_id: 2186224
description:
Jan 14 02:06:44 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.73.168.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.88
country_id: 2186224
description:
2026-01-14 02:06:46 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.168.88]:51372: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.186.230.20
country_id: 1562822
description:
Jan 14 02:06:25 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.186.230.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.186.230.20
country_id: 1562822
description:
2026-01-14 02:06:27 dovecot_login authenticator failed for H=([127.0.0.1]) [113.186.230.20]:41232: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.178
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/fontello/font/fontello09eb.woff?22036640 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.194.8.228
country_id: 99237
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/about.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.238
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/fontello/css/animation.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.137
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/__packed.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.185
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/fontello/css/fontello.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.133
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/style.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.244.255.2
country_id: 3469034
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.220
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/shortcodes.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.186
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/kidscare.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.153
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/responsive.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 20.215.220.109
country_id: 798544
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/run/dovecot/dovecot.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.117.0.253
country_id: 1835841
description:
Jan 14 02:09:23 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.117.0.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2026-01-14 02:09:25 dovecot_login authenticator failed for H=([222.117.0.253]) [222.117.0.253]:55858: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.60
country_id: 953987
description:
Jan 14 02:10:31 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.32.83
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=78381515570735 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.249.97.118
country_id: 3469034
description:
Jan 14 02:10:53 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.249.97.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 02:11:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60809: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.249.97.118
country_id: 3469034
description:
Jan 14 02:11:08 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.249.97.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.150.243.22
country_id: 6252001
description:
Jan 14 02:11:11 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.150.243.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-14 02:11:13 dovecot_plain authenticator failed for H=(holowls) [12.150.243.22]:2383: 535 Incorrect authentication data (set_id=info@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 02:11:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60810: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
country_id: 1835841
description:
Jan 14 02:12:27 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-14 02:12:29 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:43518: 535 Incorrect authentication data (set_id=dmca@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.196.35
country_id: 1562822
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.28.129
country_id: 1562822
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/images/SUU_4225 (1).jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 101.53.237.132
country_id: 1168579
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/images/logo-footer-new.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.29.19.115
country_id: 294640
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/images/slidernew.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.177.76.151
country_id: 3469034
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/images/exec-chairman-msg.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.6.27.128
country_id: 3469034
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/images/DSC00502 (1).jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.15.190
country_id: 1562822
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/images/background_about.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.70.196.115
country_id: 2661886
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/images/logo-maa-new.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.43
country_id: 3469034
description:
Jan 14 02:14:06 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.189
country_id: 3865483
description:
Jan 14 02:15:02 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.43
country_id: 3469034
description:
Jan 14 02:14:14 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.159.87.46
country_id: 3469034
description:
Jan 14 02:14:37 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.159.87.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.189
country_id: 3865483
description:
Jan 14 02:15:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.183.180.108
country_id: 1814991
description:
Jan 14 02:16:00 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.183.180.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
country_id: 1814991
description:
2026-01-14 02:16:02 dovecot_login authenticator failed for H=([118.183.180.108]) [118.183.180.108]:17192: 535 Incorrect authentication data (set_id=hapiz@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.20.31
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=432867 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.178.206
country_id: 1269750
description:
Jan 14 02:19:19 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.178.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2026-01-14 02:19:21 dovecot_login authenticator failed for H=([182.95.178.206]) [182.95.178.206]:42270: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.250.191.189
country_id: 458258
description:
Jan 14 02:21:52 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.250.191.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2026-01-14 02:21:54 dovecot_login authenticator failed for H=([178.250.191.189]) [178.250.191.189]:34704: 535 Incorrect authentication data (set_id=wgoeqsscr@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.205.226
country_id: 3469034
description:
Jan 14 02:23:33 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.205.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-14 02:23:41 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:59283: 535 Incorrect authentication data (set_id=offers@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.0.55.229
country_id: 1814991
description:
Jan 14 02:25:14 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.0.55.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.0.55.229
country_id: 1814991
description:
2026-01-14 02:25:16 dovecot_login authenticator failed for H=([218.0.55.229]) [218.0.55.229]:41716: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2026-01-14 02:25:21 dovecot_login authenticator failed for H=(m121-202-138-181.smartone.com) [121.202.138.181]:59662: 535 Incorrect authentication data (set_id=slgoh@kendek.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.138.181
country_id: 1819730
description:
Jan 14 02:25:19 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.138.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.138.198
country_id: 1814991
description:
Jan 14 02:26:03 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.138.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.138.198
country_id: 1814991
description:
2026-01-14 02:26:05 dovecot_login authenticator failed for H=([150.129.138.198]) [150.129.138.198]:59069: 535 Incorrect authentication data (set_id=general)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.200.180.174
country_id: 6252001
description:
Jan 14 02:26:58 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.200.180.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2026-01-14 02:27:00 dovecot_login authenticator failed for H=survey.hagbergconsulting.com [207.200.180.174]:61870: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.205
country_id: 2395170
description:
Jan 14 02:27:19 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-14 02:30:27 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:50068: 535 Incorrect authentication data (set_id=offers@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.23.237.58
country_id: 1269750
description:
Jan 14 02:30:34 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.23.237.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.58
country_id: 1269750
description:
2026-01-14 02:30:36 dovecot_login authenticator failed for H=([127.0.0.1]) [125.23.237.58]:37850: 535 Incorrect authentication data (set_id=wanfazris@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.130.35.13
country_id: 1668284
description:
Jan 14 02:30:49 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.130.35.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.130.35.13
country_id: 1668284
description:
2026-01-14 02:30:51 dovecot_login authenticator failed for H=220-130-35-13.hinet-ip.hinet.net ([127.0.0.1]) [220.130.35.13]:49827: 535 Incorrect authentication data (set_id=wanfazris)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 175.44.2.144
country_id: 1814991
domain: www.kendek.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/mailto:stefen@kendek.com||User:kendek||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.232.60.66
country_id: 3469034
description:
Jan 14 02:33:50 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.232.60.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.24.202.135
country_id: 798544
description:
Jan 14 02:34:12 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.24.202.135 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/sliders/survey-meter.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.116
country_id: 690791
description:
Jan 14 02:37:24 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.79
country_id: 1269750
description:
Jan 14 02:37:55 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.79
country_id: 1269750
description:
Jan 14 02:38:08 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.79 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 72.57.74.195
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-38.72.57.74.195||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 02:39:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60829: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 02:39:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60830: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.187
country_id: 1269750
description:
Jan 14 02:41:00 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.147.137.78
country_id: 2542007
description:
2026-01-14 02:40:49 dovecot_plain authenticator failed for H=([172.31.240.1]) [197.147.137.78]:54961: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.187
country_id: 1269750
description:
Jan 14 02:41:13 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.119
country_id: 298795
description:
Jan 14 02:41:16 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.147.137.78
country_id: 2542007
description:
2026-01-14 02:41:26 dovecot_plain authenticator failed for H=([172.31.240.1]) [197.147.137.78]:55147: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.147.137.78
country_id: 2542007
description:
2026-01-14 02:42:41 dovecot_plain authenticator failed for H=([172.31.240.1]) [197.147.137.78]:50355: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.30
country_id: 3077311
description:
Jan 14 02:42:19 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.82
country_id: 3175395
description:
Jan 14 02:42:38 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.147.137.78
country_id: 2542007
description:
2026-01-14 02:43:15 dovecot_plain authenticator failed for H=([172.31.240.1]) [197.147.137.78]:64528: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.189.89.85
country_id: 3895114
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?route=product/search&tag=b031-0001 - rsc plain carton HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.31
country_id: 1269750
description:
Jan 14 02:50:33 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.48.40
country_id: 2963597
description:
Jan 14 02:52:35 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.48.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.96
country_id: 3175395
description:
Jan 14 02:52:53 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.96 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.52.3.146
country_id: 6252001
domain: www.aircarbonic.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.52.3.146
country_id: 6252001
domain: www.aircarbonic.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/77.0.3865.120 Safari/537.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.13.138.139
country_id: 3175395
description:
Jan 14 02:53:11 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.13.138.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.86.158.1
country_id: 102358
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/busy/14/379/1448284 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.168.138.138
country_id: 3996063
description:
Jan 14 02:53:41 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.168.138.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.2
country_id: 933860
description:
Jan 14 02:55:44 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.134.51.80
country_id: 6252001
domain: tujusetia.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.0.0 Safari/537.36||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.116.175.137
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=724064 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.150
country_id: 3469034
description:
Jan 14 02:56:44 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.130
country_id: 3469034
description:
Jan 14 02:56:18 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.70
country_id: 3175395
description:
Jan 14 02:56:39 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 105.101.28.201
country_id: 2589581
description:
2026-01-14 02:58:38 H=([105.101.28.201]) [105.101.28.201]:33514 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.15.237
country_id: 99237
domain: www.symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.symphony-led.com/products/media-facade-2/outdoor-led-screen-c1-series/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 105.101.28.201
country_id: 2589581
description:
2026-01-14 02:59:48 H=([105.101.28.201]) [105.101.28.201]:34031 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.168.50.165
country_id: 3469034
description:
2026-01-14 02:59:15 H=([45.168.50.199]) [45.168.50.165]:38434 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.168.50.234
country_id: 3469034
description:
2026-01-14 03:00:33 H=([45.168.50.199]) [45.168.50.234]:38914 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.148.249.72
country_id: 6252001
description:
[2026-01-14 03:01:01 +0800] info [cpaneld] 34.148.249.72 - - "GET /wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 34.148.249.72
country_id: 6252001
description:
[2026-01-14 03:01:06 +0800] info [cpaneld] 34.148.249.72 - - "GET /wp2/wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 105.101.28.201
country_id: 2589581
description:
2026-01-14 03:00:29 H=([105.101.28.201]) [105.101.28.201]:34310 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 105.101.28.201
country_id: 2589581
description:
2026-01-14 03:01:10 H=([105.101.28.201]) [105.101.28.201]:34342 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.168.50.234
country_id: 3469034
description:
2026-01-14 03:01:20 H=([45.168.50.199]) [45.168.50.234]:39207 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.250.179.209
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/28iterator.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.204.244
country_id: 3469034
description:
Jan 14 03:05:15 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.204.244 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.203
country_id: 298795
description:
Jan 14 03:05:37 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.211
country_id: 3469034
description:
Jan 14 03:05:09 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 03:07:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60858: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 64.137.8.136
country_id: 2510769
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-06.64.137.8.136||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.243.119
country_id: 6252001
description:
2026-01-14 03:06:57 H=([91.92.243.119]) [91.92.243.119]:52463 F=<ribarra@pasa.mx> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 03:07:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60858: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.163
country_id: 3175395
description:
Jan 14 03:09:20 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.140.123.15
country_id: 6290252
description:
Jan 14 03:09:21 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.140.123.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.81
country_id: 3865483
description:
Jan 14 03:09:43 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-14 03:11:44 H=(localhost.localdomain) [78.153.140.207]:33644 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.16.219
country_id: 6252001
description:
Jan 14 03:12:20 sv3 pure-ftpd[1241408]: (?@45.38.16.219) [WARNING] Authentication failed for user [woodlinetrd]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.32
country_id: 3077311
description:
Jan 14 03:14:53 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.29.15.93
country_id: 3439705
domain: af-sb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.com/img-sys/powered_by_cpanel.svg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/demos/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.236.147
country_id: 1562822
domain: af-sb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.com/img-sys/server_misconfigured.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.213.132.227
country_id: 953987
domain: af-sb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.com/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.213.132.227
country_id: 953987
domain: af-sb.comhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.comhttp/af-sb.com/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.154.36
country_id: 99237
description:
Jan 14 03:15:23 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.154.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.236.53.198
country_id: 1814991
description:
Jan 14 03:16:58 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.236.53.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.236.53.198
country_id: 1814991
description:
2026-01-14 03:17:00 dovecot_login authenticator failed for H=([115.236.53.198]) [115.236.53.198]:46246: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.53.189
country_id: 2635167
description:
Jan 14 03:17:06 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.101.53.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/services.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.25.93.177
country_id: 2017370
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=381667 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.231.114
country_id: 1269750
description:
Jan 14 03:18:22 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.231.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.114
country_id: 1269750
description:
2026-01-14 03:18:24 dovecot_login authenticator failed for H=([182.95.13.25]) [128.185.231.114]:43218: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/survey-meter.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.47.146
country_id: 1819730
description:
Jan 14 03:23:46 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.47.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-01-14 03:23:48 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:49781: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/sliders/radioactive.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.237
country_id: 3469034
description:
Jan 14 03:24:46 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.78.89.45
country_id: 298795
description:
Jan 14 03:25:08 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.78.89.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.212
country_id: 3469034
description:
Jan 14 03:26:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.134
country_id: 3469034
description:
Jan 14 03:26:38 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.134 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.207.86.137
country_id: 2017370
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/shout/454/636567 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.56
country_id: 732800
description:
Jan 14 03:28:45 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.56 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 206.168.34.113
country_id: 6252001
description:
Jan 14 03:31:24 sv3 pure-ftpd[1258392]: (?@206.168.34.113) [INFO] New connection from 206.168.34.113


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 03:33:18 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.249
country_id: 3175395
description:
Jan 14 03:33:34 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.23
country_id: 3175395
description:
Jan 14 03:33:53 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.252.81
country_id: 3865483
description:
Jan 14 03:34:41 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.252.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 03:35:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60889: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 03:35:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60889: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.216
country_id: 3469034
description:
Jan 14 03:36:06 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.11.198
country_id: 690791
description:
Jan 14 03:36:27 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.11.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.144
country_id: 3469034
description:
Jan 14 03:36:47 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.216
country_id: 3469034
description:
Jan 14 03:36:14 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.248.32
country_id: 798544
description:
Jan 14 03:38:02 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.248.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.45
country_id: 3175395
description:
Jan 14 03:37:19 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 03:37:51 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.248.32
country_id: 798544
description:
Jan 14 03:38:09 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.248.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.202
country_id: 3175395
description:
Jan 14 03:38:20 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.202 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.102.66.7
country_id: 2542007
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/9421503242.jpg&size=1000x1000 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-14 03:41:36 H=([77.83.39.92]) [77.83.39.92]:57657 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <enquiry@symphony-led.com>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.119.112.69
country_id: 6252001
description:
Jan 14 03:45:25 sv3 pure-ftpd[1266205]: (?@135.119.112.69) [INFO] New connection from 135.119.112.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.7.72.136
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=19 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.43.184.206
country_id: 2510769
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-47.45.43.184.206||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.246.211
country_id: 3865483
description:
Jan 14 03:47:35 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.246.211 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.129
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/js/fancybox/jquery.fancybox.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.140
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/js/animations/animate.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.137
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/js/ytplayer/css/YTPlayer.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.149
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/miuiconfont/miuiconfont.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.152
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/vendor/rs-plugin/css/settings.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.154
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/vendor/rs-plugin/css/layers.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.150
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/css/bootstrap.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/images/article.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.180.202.83
country_id: 3469034
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/product-sub.php?id=24&sub=29 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.130
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/css/pages-style.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.131
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/fontawesome/css/font-awesome.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.148
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/js/bxslider/jquery.bxslider.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.208.125
country_id: 798544
description:
Jan 14 03:52:50 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.208.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.203
country_id: 2510769
description:
Jan 14 03:53:07 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.214.16
country_id: 798544
description:
Jan 14 03:52:18 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.214.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.76.82.82
country_id: 2328926
description:
Jan 14 03:53:12 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.76.82.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.203
country_id: 2510769
description:
Jan 14 03:53:14 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.214.16
country_id: 798544
description:
Jan 14 03:53:37 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.214.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.229
country_id: 3469034
description:
Jan 14 03:53:37 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.229 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/portfolio-new.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.60
country_id: 3469034
description:
Jan 14 03:57:53 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.37.31.106
country_id: 1168579
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/p-4.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.60
country_id: 3469034
description:
Jan 14 03:58:08 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.83.101.22
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/come/16/156/1651009 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.18
country_id: 3469034
description:
Jan 14 03:58:50 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.96
country_id: 3469034
description:
Jan 14 03:58:55 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.154
country_id: 3469034
description:
Jan 14 03:59:08 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.96
country_id: 3469034
description:
Jan 14 03:59:11 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.48.12.87
country_id: 2510769
description:
Jan 14 03:59:43 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.48.12.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.120.129.7
country_id: 690791
description:
Jan 14 04:00:09 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.120.129.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.185
country_id: 3469034
description:
Jan 14 04:00:29 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/apm/images/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 44.244.53.83
country_id: 6252001
domain: geminiflourmill.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/blog/mon/particulier/loginform3ad6.php||SC:/home2/cabecom/public_html/img/blog||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 04:03:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60917: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.44.8.235
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/26utf8.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 04:03:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60918: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 103.221.55.57
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-12.103.221.55.57||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.163.192.207
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/noisenorth/138/288578 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.252.225
country_id: 3865483
description:
Jan 14 04:14:53 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.252.225
country_id: 3865483
description:
Jan 14 04:15:08 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.91.103.202
country_id: 6252001
description:
Jan 14 04:16:58 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.91.103.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2026-01-14 04:17:00 dovecot_plain authenticator failed for H=c-24-91-103-202.hsd1.ma.comcast.net (dinosped) [24.91.103.202]:55724: 535 Incorrect authentication data (set_id=no-replay@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.198.73
country_id: 798544
description:
Jan 14 04:18:27 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.198.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.198.73
country_id: 798544
description:
2026-01-14 04:18:29 dovecot_plain authenticator failed for H=5.185.198.73.ipv4.public.orange.pl (prolity) [5.185.198.73]:48652: 535 Incorrect authentication data (set_id=jasperchong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.120.223.116
country_id: 1814991
description:
Jan 14 04:19:49 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.120.223.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.120.223.116
country_id: 1814991
description:
2026-01-14 04:19:51 dovecot_login authenticator failed for H=(Wlnlh9vJ) [180.120.223.116]:8640: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.121.240.103
country_id: 1814991
description:
Jan 14 04:19:36 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.121.240.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.121.240.103
country_id: 1814991
description:
2026-01-14 04:19:38 dovecot_login authenticator failed for H=(FtAcoCgH) [180.121.240.103]:56741: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.205
country_id: 6252001
description:
Jan 14 04:19:40 sv3 pure-ftpd[1285892]: (?@198.235.24.205) [INFO] New connection from 198.235.24.205


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.79.161.17
country_id: 1814991
description:
Jan 14 04:19:42 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.79.161.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.79.161.17
country_id: 1814991
description:
2026-01-14 04:19:44 dovecot_login authenticator failed for H=(BpamnvG7) [49.79.161.17]:1176: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
country_id: 6252001
description:
Jan 14 04:21:19 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.73.169.63
country_id: 2186224
description:
Jan 14 04:22:49 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.73.169.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.63
country_id: 2186224
description:
2026-01-14 04:22:51 dovecot_login authenticator failed for H=([121.73.169.63]) [121.73.169.63]:49796: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.175.174
country_id: 6252001
description:
Jan 14 04:23:09 sv3 pure-ftpd[1287537]: (?@40.124.175.174) [INFO] New connection from 40.124.175.174


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.53.44
country_id: 1269750
description:
Jan 14 04:23:56 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.53.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 18.118.114.117
country_id: 6252001
domain: www.sv3.nocser.net
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.63||T:APACHE||REQUEST_URI:/wp-content/plugins/suretriggers/readme.txt||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 14 04:24:54 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:24:56 dovecot_login authenticator failed for H=(0W4Df6) [158.94.208.175]:54786: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 14 04:25:19 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:25:21 dovecot_login authenticator failed for H=(tjHlzpoXF) [158.94.208.175]:50359: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-14 04:25:46 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:48885: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:26:09 dovecot_login authenticator failed for H=(blqc29QjvE) [158.94.208.175]:51297: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 14 04:26:30 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 14 04:27:17 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:27:19 dovecot_login authenticator failed for H=(LV8jnzZ) [158.94.208.175]:64926: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.92.66.188
country_id: 6251999
description:
Jan 14 04:27:25 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.92.66.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.92.66.188
country_id: 6251999
description:
2026-01-14 04:27:27 dovecot_login authenticator failed for H=([147.92.66.188]) [147.92.66.188]:57106: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 14 04:28:26 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:28:28 dovecot_login authenticator failed for H=(4XkRcYl) [158.94.208.175]:63715: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 14 04:29:12 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:29:14 dovecot_login authenticator failed for H=(dJSsMvF86) [158.94.208.175]:60437: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.125.52.158
country_id: 2510769
description:
Jan 14 04:30:02 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.125.52.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.125.52.158
country_id: 2510769
description:
Jan 14 04:30:09 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.125.52.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 14 04:30:13 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:30:15 dovecot_login authenticator failed for H=(hjWkpz5l) [158.94.208.175]:51759: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.119
country_id: 3469034
description:
Jan 14 04:30:33 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:30:34 dovecot_login authenticator failed for H=(LS9U5v9C) [158.94.208.175]:52638: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 04:31:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60948: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/demos/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 14 04:31:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:31:12 dovecot_login authenticator failed for H=(6J20Xs5c) [158.94.208.175]:50111: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 04:31:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60949: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:32:10 dovecot_login authenticator failed for H=(68AAdkVHT) [158.94.208.175]:54340: 535 Incorrect authentication data (set_id=limls)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 14 04:32:08 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.219.12.66
country_id: 3469034
description:
Jan 14 04:33:29 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.219.12.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.41.185.196
country_id: 3625428
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-85.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.43
country_id: 3469034
description:
Jan 14 04:33:58 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2026-01-14 04:33:41 dovecot_login authenticator failed for H=([125.19.175.152]) [182.78.241.102]:52730: 535 Incorrect authentication data (set_id=slgoh@kendek.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.0.83.168
country_id: 1562822
description:
Jan 14 04:33:46 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.0.83.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.0.83.168
country_id: 1562822
description:
2026-01-14 04:33:48 dovecot_login authenticator failed for H=([127.0.0.1]) [117.0.83.168]:53989: 535 Incorrect authentication data (set_id=inf@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.14.56.116
country_id: 3017382
description:
Jan 14 04:33:59 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.14.56.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 14 04:33:25 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:33:27 dovecot_login authenticator failed for H=(re2WaKEMP) [158.94.208.175]:57690: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.241.102
country_id: 1269750
description:
Jan 14 04:33:39 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.241.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.56.116
country_id: 3017382
description:
2026-01-14 04:34:01 dovecot_login authenticator failed for H=laubervilliers-657-1-120-116.w80-14.abo.wanadoo.fr [80.14.56.116]:43946: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 14 04:34:22 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:34:24 dovecot_login authenticator failed for H=(SbK1aF5) [158.94.208.175]:53873: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.91.85.7
country_id: 3437598
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/swiftmailer/swiftmailer/doc/headers.rst HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.44.32.144
country_id: 2017370
description:
Jan 14 04:34:35 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.44.32.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.32.144
country_id: 2017370
description:
2026-01-14 04:34:37 dovecot_login authenticator failed for H=([46.44.32.144]) [46.44.32.144]:56960: 535 Incorrect authentication data (set_id=lkwong.isc@vc-b.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:34:44 dovecot_login authenticator failed for H=(ouEvD2BgZ5) [158.94.208.175]:53864: 535 Incorrect authentication data (set_id=limls)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/img/druma_photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 14 04:35:21 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:35:23 dovecot_login authenticator failed for H=(xbOjTmI) [158.94.208.175]:52873: 535 Incorrect authentication data (set_id=limls)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.237.3.116
country_id: 3932488
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Easy Fold Document Box/Easy Fold - Bottom-150x150.JPG HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.231.161.2
country_id: 3624060
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Easy Fold Document Box/Easy Fold - 5 File Box-4-150x150.JPG HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 14 04:36:18 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:36:20 dovecot_login authenticator failed for H=(yAimanrP) [158.94.208.175]:51893: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 14 04:37:17 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:37:19 dovecot_login authenticator failed for H=(dpsBI9ObF) [158.94.208.175]:54522: 535 Incorrect authentication data (set_id=limls)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/img/druma_photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 14 04:38:13 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:38:15 dovecot_login authenticator failed for H=(eTffuKBGB) [158.94.208.175]:52469: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:39:31 dovecot_login authenticator failed for H=(ZACxY9hV) [158.94.208.175]:53844: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.26
country_id: 1269750
description:
2026-01-14 04:39:48 dovecot_login authenticator failed for H=([128.185.201.26]) [128.185.201.26]:36010: 535 Incorrect authentication data (set_id=jyteh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 14 04:39:13 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:39:15 dovecot_login authenticator failed for H=(zk7ARuIA) [158.94.208.175]:57810: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.201.26
country_id: 1269750
description:
Jan 14 04:39:46 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.201.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:40:10 dovecot_login authenticator failed for H=(2LuLTn) [158.94.208.175]:58407: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 14 04:40:30 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.217.155.59
country_id: 587116
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/1900553621.jpg&size=1000x1000 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 14 04:41:09 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-14 04:41:11 dovecot_login authenticator failed for H=(l95WQOsy4Y) [158.94.208.175]:60996: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.216.141
country_id: 99237
description:
Jan 14 04:43:02 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.216.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.219.12.66
country_id: 3469034
description:
Jan 14 04:43:55 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.219.12.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.45.239
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/Menu Master.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.216.141
country_id: 99237
description:
Jan 14 04:43:12 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.216.141 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/introduction-service.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.219.12.66
country_id: 3469034
description:
Jan 14 04:44:09 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.219.12.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.90.177.156
country_id: 192950
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/php-file-iterator/src HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.250.36.51
country_id: 3437598
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/php-file-iterator/src/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.140.69
country_id: 3658394
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/DocQ Rack   FileBox/DocQ Rack-4-120x120.JPG HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/dosimeter.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.209.202.212
country_id: 3469034
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-50.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 103.53.216.74
country_id: 2077456
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-51.103.53.216.74||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.8.145.84
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/sebastian/diff/src/Line.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/plug/sms/img/news.php||SC:/home2/pspolycom/public_html/plug||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.26
country_id: 3469034
description:
Jan 14 04:57:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-14 04:58:53 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:56287: 535 Incorrect authentication data (set_id=admin@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 04:59:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60965: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 04:59:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60966: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.212.125.207
country_id: 3617476
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=995382 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.189.58.33
country_id: 3658394
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/Wise.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.177.44.124
country_id: 2542007
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/ramsey/uuid/src/UuidFactory.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.201.35.183
country_id: 290291
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=10561515046765 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.36.6
country_id: 3469034
description:
Jan 14 05:05:50 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.36.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.159.21.170
country_id: 1835841
description:
Jan 14 05:06:57 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.159.21.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.159.21.170
country_id: 1835841
description:
2026-01-14 05:06:59 dovecot_login authenticator failed for H=([221.159.21.170]) [221.159.21.170]:45762: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.201.193.153
country_id: 3625428
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=762538 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.93.80.158
country_id: 1269750
description:
Jan 14 05:10:35 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.93.80.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2026-01-14 05:10:37 dovecot_login authenticator failed for H=(victoryent.in) [111.93.80.158]:42628: 535 Incorrect authentication data (set_id=lkwong.isc@vc-b.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.154.35.228
country_id: 2750405
description:
2026-01-14 05:11:39 H=([94.154.35.228]) [94.154.35.228]:53873 F=<kuzu@kuzuflex.com> rejected RCPT <cky@ahfengineering.com>: SPF: 94.154.35.228 is not allowed to send mail from kuzuflex.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.196.209.55
country_id: 6252001
description:
Jan 14 05:12:19 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.196.209.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.196.209.55
country_id: 6252001
description:
2026-01-14 05:12:21 dovecot_plain authenticator failed for H=c-98-196-209-55.hsd1.tx.comcast.net (oberm) [98.196.209.55]:40408: 535 Incorrect authentication data (set_id=subha@dps-comsec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 15.228.22.130
country_id: 3469034
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/Manitowoc.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2026-01-14 05:15:40 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (metter) [73.230.86.50]:35828: 535 Incorrect authentication data (set_id=fitriyah@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.230.86.50
country_id: 6252001
description:
Jan 14 05:15:38 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.230.86.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.22.150
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-38.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.94.104.249
country_id: 1269750
description:
[2026-01-14 05:22:39 +0800] info [webmaild] 172.94.104.249 - takao-nakashima@mckd.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.238.251.212
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-22.77.238.251.212||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2026-01-14 05:22:22 dovecot_plain authenticator failed for H=c-24-98-45-238.hsd1.ga.comcast.net (amletican) [24.98.45.238]:60012: 535 Incorrect authentication data (set_id=support@dps-comsec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.9.69.64
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=219327 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 05:25:40 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 05:27:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60997: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.234.62
country_id: 798544
description:
Jan 14 05:27:40 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.234.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.146.246.96
country_id: 3996063
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/product-detail.php?id=234981 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 05:27:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60998: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.219.102.220
country_id: 3703430
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/surprise/12/450/1207083 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.103.120.35
country_id: 3617476
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=18671514511844 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 05:30:13 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.8.32.218
country_id: 6254930
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/translation/PluralizationRules.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.255.89.253
country_id: 2963597
domain: af-sb.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.0 Safari/537.36||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.196.246.24
country_id: 3996063
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Easy Fold Document Box/Easy Fold - Side-150x150.JPG HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.181.59.87
country_id: 3469034
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Easy Fold Document Box/Easy Fold Document Box-1-150x150.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.132.156.2
country_id: 3865483
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/p-6.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 80.82.70.133
country_id: 241170
description:
2026-01-14  5:39:58 14392 [Warning] Aborted connection 14392 to db: 'unconnected' user: 'unauthenticated' host: '80.82.70.133' (This connection closed normally without authentication)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.88.114.5
country_id: 2328926
description:
[2026-01-14 05:41:39 +0800] info [webmaild] 102.88.114.5 - import@agsaintifik.com.my "GET /cpsess4597037990/3rdparty/roundcube/index.php HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.89.85.159] != Current IP Address [102.88.114.5]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-14 05:42:13 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:58677: 535 Incorrect authentication data (set_id=news@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.106.206.210
country_id: 3469034
domain: ms-chemicals.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ms-chemicals.net/wp-content/uploads/slide02.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.20.116
country_id: 99237
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-5.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-14 05:47:14 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:43066: 535 Incorrect authentication data (set_id=news@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.239.194.142
country_id: 99237
domain: nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nmahir.com/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 196.251.100.209
country_id: 241170
description:
2026-01-14  5:50:07 14801 [Warning] Aborted connection 14801 to db: 'unconnected' user: 'unauthenticated' host: '196.251.100.209' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.189.153.167
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/css-selector/LICENSE HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 05:55:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61019: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.118
country_id: 3469034
description:
Jan 14 05:55:26 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.226.31.237
country_id: 1562822
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/Hatco.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 05:55:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61020: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.143.59.184
country_id: 6252001
description:
2026-01-14 05:56:12 dovecot_login authenticator failed for H=([166.143.59.184]) [166.143.59.184]:9556: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.250.214.191
country_id: 2542007
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/images/3.jpeg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.213.19.94
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/8933024424.jpg&size=1000x1000 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/m.me/img/photos/article.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.238.251.212
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-04.77.238.251.212||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.172.8.42
country_id: 3996063
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/fight/10/323/1098344 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/img/photos/img/photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/images/sliders/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.213.46
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=30571515379569 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.2.182
country_id: 2017370
description:
2026-01-14 06:11:37 dovecot_plain authenticator failed for H=(conic) [31.173.2.182]:27103: 535 Incorrect authentication data (set_id=kimmeng.tan@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.90.120.53
country_id: 1814991
description:
Jan 14 06:11:47 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.90.120.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.90.120.53
country_id: 1814991
description:
2026-01-14 06:11:49 dovecot_login authenticator failed for H=([218.90.120.53]) [218.90.120.53]:44588: 535 Incorrect authentication data (set_id=slgoh@kendek.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.84.93.89
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=70&page=4 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.2.182
country_id: 2017370
description:
Jan 14 06:11:35 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.2.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 129.150.46.190
country_id: 1880251
domain: www.kendek.com
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:-dsafe_mode=off -ddisable_functions=null -dallow_url_fopen=on -dallow_url_include=on -dauto_prepend_file=https://cld.pt/dl/download/58887b17-33bd-494e-983d-6b9b494045ff/link.txt||MVN:MATCHED_VAR||WPU:||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 150.242.170.6
country_id: 1814991
description:
2026-01-14 06:16:27 H=([150.242.170.6]) [150.242.170.6]:57813 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<enquiry@smartcable.com.my> rejected RCPT <enquiry@smartcable.com.my>: smtp auth required


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.187.170.129
country_id: 6252001
description:
[2026-01-14 06:16:49 +0800] info [webmaild] 89.187.170.129 - chew@nexuscollection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-us/images/sliders/faq.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2026-01-14 06:21:19 dovecot_plain authenticator failed for H=(wisic) [5.11.141.74]:42280: 535 Incorrect authentication data (set_id=alvin.ng@tujusetia.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 150.242.170.6
country_id: 1814991
description:
2026-01-14 06:21:11 H=([150.242.170.6]) [150.242.170.6]:65192 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<hr_admin@smartcable.com.my> rejected RCPT <hr_admin@smartcable.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.141.74
country_id: 298795
description:
Jan 14 06:21:17 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.141.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/demos/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 06:23:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61040: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/plug/sms/img/about.php||SC:/home2/pspolycom/public_html/plug||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 06:23:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61041: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.250.221
country_id: 1562822
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/Cuppone.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.245.55
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/p-8.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.174.210.126
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-55.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.181.79.60
country_id: 1819730
description:
Jan 14 06:30:45 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.181.79.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2026-01-14 06:30:47 dovecot_login authenticator failed for H=([65.181.79.60]) [65.181.79.60]:55935: 535 Incorrect authentication data (set_id=hapiz@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.178.55.200
country_id: 3865483
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Easy Fold Document Box/Easy Fold Document Box-4-250x250.JPG HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/img/photos/img/photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/login.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.117.225.72
country_id: 2264397
domain: oxbold.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-sinaran-utama-teknologi/images/news.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/m.me/img/photos/contact.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 06:51:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61073: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/sliders/contact.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.163.98
country_id: 3996063
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/index.php?Itemid=151&id=6:competency-challenges-for-the-future-industry-a-future-fast-forward-by-prof-shahir-liew&option=com_phocagallery&view=category HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 06:51:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61074: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.124.236.93
country_id: 2245662
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/fzaninotto/faker/src/Faker/Provider HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.179
country_id: 6252001
description:
Jan 14 06:54:37 sv3 pure-ftpd[1380930]: (?@198.235.24.179) [INFO] New connection from 198.235.24.179


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.166.70.136
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product-detail.php?id=4111725259 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/survey-meter.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.232.239.249
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/finder/Tests/FinderTest.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.124.17.8
country_id: 6252001
description:
2026-01-14 07:04:09 dovecot_plain authenticator failed for H=([10.6.18.77]) [91.124.17.8]:26431: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.188.227.204
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/Waring.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.242.178.116
country_id: 6251999
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-10.196.242.178.116||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.34.186.180
country_id: 6252001
description:
Jan 14 07:11:14 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.34.186.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.34.186.180
country_id: 6252001
description:
2026-01-14 07:11:16 dovecot_login authenticator failed for H=([12.34.186.180]) [12.34.186.180]:42190: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 174.55.138.245
country_id: 6252001
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/windsurfingmalaysia-tnc.htm HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 07:19:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61104: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 07:19:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61105: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.174.233.246
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-20.107.174.233.246||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 07:22:32 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.91.86.213
country_id: 3437598
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/food/18/720/1885475 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.27.205.159
country_id: 1814991
description:
Jan 14 07:30:39 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.27.205.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.27.205.159
country_id: 1814991
description:
2026-01-14 07:30:41 dovecot_login authenticator failed for H=([218.27.205.159]) [218.27.205.159]:39516: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.9.161.6
country_id: 1643084
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-10.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.141.248
country_id: 1562822
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 62.171.158.119
country_id: 2921044
domain: acburn.com.my
description:
IM360 WAF: Possible XSS in arguments||MV:<svg xmlns=\"http://www.w3.org/2000/svg\"><script>prompt(\"xss\")</script></svg>||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.177.147.118
country_id: 1562822
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Easy Fold Document Box/Easy Fold - 5 File Box-3-150x150.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 46.202.78.239
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-40.46.202.78.239||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 173.234.154.170
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-46.173.234.154.170||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 07:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61128: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 07:47:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61129: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.168.135.240
country_id: 3469034
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-77.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.102.145.225
country_id: 2589581
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/8574404927.jpg&size=1000x1000 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.219.169.48
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=2&sub=6 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.51.181.19
country_id: 1733045
description:
[2026-01-14 07:55:15 +0800] info [webmaild] 60.51.181.19 - safuddin@ajplantations.com.my "POST /cpsess1340782405/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [211.25.18.142] != Current IP Address [60.51.181.19]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.119.201.42
country_id: 2400553
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/gcb-product.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.3.50.226
country_id: 3865483
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/fkrm-motor.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.118
country_id: 3469034
description:
Jan 14 07:56:53 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/demos/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cert.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.114.32.221
country_id: 3895114
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/6570274315.jpg&size=1000x1000 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.96.22.45
country_id: 3895114
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/01simple.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.180.161.78
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/training-details.php?id=901164 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 85.215.184.132
country_id: 2921044
domain: sutsb.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.63||T:APACHE||RA:85.215.184.132||TA:85.215.184.132||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.42.8
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-07.142.111.42.8||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.72.109.130
country_id: 3469034
domain: langkawiconstructions.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/langkawiconstructions.com/slide-page/construction-work HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.124.247.207
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/2460079596.jpg&size=1000x1000 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.65.118.172
country_id: 357994
description:
Jan 14 08:12:02 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.65.118.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.65.118.172
country_id: 357994
description:
2026-01-14 08:12:04 dovecot_plain authenticator failed for H=(undlet) [41.65.118.172]:60902: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.251.179.26
country_id: 1835841
description:
Jan 14 08:12:16 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.251.179.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.251.179.26
country_id: 1835841
description:
2026-01-14 08:12:18 dovecot_login authenticator failed for H=([127.0.0.1]) [203.251.179.26]:50190: 535 Incorrect authentication data (set_id=jessieteoh@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 08:15:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61159: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 08:15:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61160: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.120.2.111
country_id: 630336
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/polyfill-util/TestListenerForV6.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 159.69.245.204
country_id: 2921044
domain: feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/128.0.0.0 Safari/537.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.52.54
country_id: 3469034
description:
Jan 14 08:17:49 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.52.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.63.52.54
country_id: 3469034
description:
2026-01-14 08:17:51 dovecot_login authenticator failed for H=(201-91-74-17.customer.tdatabrasil.net.br) [201.63.52.54]:37089: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.169.23.135
country_id: 3017382
description:
2026-01-14 08:18:52 dovecot_login authenticator failed for H=basti-fritzsche.de (lvps83-169-23-135.dedicated.hosteurope.de) [83.169.23.135]:59214: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.228.213
country_id: 3437598
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=268452 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.181.107.75
country_id: 660013
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/about.php||SC:/home2/feliogroupcom/public_html/images/about.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.181.107.75
country_id: 660013
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/index.php||SC:/home2/feliogroupcom/public_html/images/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.101.5.106
country_id: 690791
description:
Jan 14 08:22:53 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.101.5.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.101.5.106
country_id: 690791
description:
2026-01-14 08:22:55 dovecot_login authenticator failed for H=([176.101.5.106]) [176.101.5.106]:59780: 535 Incorrect authentication data (set_id=nicholas@eminent.st)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/druma_photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.55.131.144
country_id: 1694008
description:
Jan 14 08:25:39 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.55.131.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.55.131.144
country_id: 1694008
description:
2026-01-14 08:25:41 dovecot_login authenticator failed for H=([122.55.143.46]) [122.55.131.144]:33764: 535 Incorrect authentication data (set_id=boss@astlog.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.196
country_id: 6252001
description:
Jan 14 08:27:12 sv3 pure-ftpd[1445449]: (?@162.142.125.196) [INFO] New connection from 162.142.125.196


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.19
country_id: 587116
description:
[2026-01-14 08:27:48 +0800] info [cpaneld] 37.114.148.19 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.97.107
country_id: 1733045
description:
[2026-01-14 08:28:42 +0800] info [webmaild] 183.171.97.107 - payment@tujusetia.my "GET /cpsess2010687009/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [183.171.74.131] != Current IP Address [183.171.97.107]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/radioactive.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 113.211.56.81
country_id: 1733045
domain: www.box.com.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.63||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-14 08:34:23 H=([185.214.10.21]) [185.214.10.21]:60378 F=<sales@cordage.com.my> rejected RCPT <sales@cordage.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-14 08:35:59 H=([185.214.10.21]) [185.214.10.21]:49853 F=<sales@pspoly.com.my> rejected RCPT <info@pspoly.com.my>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-14 08:36:16 H=([185.214.10.21]) [185.214.10.21]:50970 F=<sales@ktlog.com.my> rejected RCPT <jacklim@ktlog.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.252.114.194
country_id: 1562822
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207162746.gif HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.112.224.109
country_id: 2328926
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207160215.gif HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.62.137.6
country_id: 3469034
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207162406.gif HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.84.81.93
country_id: 3686110
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207165858.gif HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.27.219.119
country_id: 3489940
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207162608.gif HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.164.32.36
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-39.194.164.32.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-14 08:39:37 +0800] info [webmaild] 115.134.149.232 - general02@smartcable.com.my "POST /cpsess0145575820/3rdparty/roundcube/?_task=mail&_unlock=loading1768351177374&_framed=1 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-14 08:41:44 H=(localhost.localdomain) [78.153.140.207]:39190 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-14 08:41:49 +0800] info [webmaild] 115.134.149.232 - enquiry@smartcable.com.my "POST /cpsess0145575820/3rdparty/roundcube/?_task=mail&_unlock=loading1768351308728&_framed=1 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 08:43:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61227: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 08:43:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61228: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.199.5
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/Dean.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-14 08:46:59 +0800] info [webmaild] 115.134.149.232 - general02@smartcable.com.my "GET /cpsess4228189374/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 204.217.131.48
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-48.204.217.131.48||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.163.145.175
country_id: 1668284
description:
Jan 14 08:49:18 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.163.145.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.197.189.174
country_id: 3703430
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-12.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.61.242
country_id: 1819730
domain: www.eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.eminent.st/wp-content/uploads/2016/11/hoffset-5.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.76.214
country_id: 1733045
description:
[2026-01-14 08:54:46 +0800] info [webmaild] 183.171.76.214 - payment@tujusetia.my "POST /cpsess2010687009/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [183.171.97.107] != Current IP Address [183.171.76.214]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-14 08:57:12 +0800] info [webmaild] 175.144.229.115 - claimservice@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/apm/images/index.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.160.153.119
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-75.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 113.211.214.9
country_id: 1733045
description:
113.211.214.9 - - [14/Jan/2026:09:02:44 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646175&pdata=https%253A%252F%252Fwww.lvconsult.com.my%253A2096%252Fcpsess7892333628%252F3rdparty%252Froundcube%252F%253F_task%253Dmail%2526_mbox%253DINBOX%2526_uid%253D44511%2526_part%253D2%2526_action%253Dget%2526_extwin%253D1%2526_framed%253D1%2526_mimewarning%253D1%2526_embed%253D1&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768352562 HTTP/2.0" 302 0 www.lvconsult.com.my "https://www.lvconsult.com.my:2096/cpsess7892333628/3rdparty/roundcube/?_task=mail&_mbox=INBOX&_uid=44511&_part=2&_action=get&_extwin=1&_framed=1&_mimewarning=1&_embed=1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 Edg/143.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:113.211.214.9


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.33.152.186
country_id: 3469034
domain: www.lvconsult.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lvconsult.com.my/wp-content/uploads/2015/10/img4-300x177.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/druma_photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.213.236.66
country_id: 6252001
description:
Jan 14 09:07:06 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.213.236.66 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 176.111.219.113
country_id: 6252001
domain: www.maalloys.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.63||T:APACHE||RA:176.111.219.113||TA:176.111.219.113||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2026-01-14 09:07:08 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (pudablable) [73.213.236.66]:44060: 535 Incorrect authentication data (set_id=office@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.142.194
country_id: 1269750
description:
Jan 14 09:07:24 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.142.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.196.209.55
country_id: 6252001
description:
Jan 14 09:09:07 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.196.209.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.196.209.55
country_id: 6252001
description:
2026-01-14 09:09:09 dovecot_plain authenticator failed for H=c-98-196-209-55.hsd1.tx.comcast.net (pospor) [98.196.209.55]:38066: 535 Incorrect authentication data (set_id=info@smartcable.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 09:10:21 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 09:11:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61383: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 09:11:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61384: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.225.98.235
country_id: 102358
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/mssa/index.php/activities/mssa-5th-council-meeting/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 09:14:54 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.54.196.238
country_id: 6252001
description:
Jan 14 09:15:12 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.54.196.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.54.196.238
country_id: 6252001
description:
2026-01-14 09:15:14 dovecot_plain authenticator failed for H=c-98-54-196-238.hsd1.tn.comcast.net (exfier) [98.54.196.238]:42322: 535 Incorrect authentication data (set_id=hazrin.izat@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.218.93.221
country_id: 3703430
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/12cellProtection.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.79.112
country_id: 1814991
description:
Jan 14 09:17:46 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.79.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.79.112
country_id: 1814991
description:
2026-01-14 09:17:48 dovecot_login authenticator failed for H=([111.26.79.111]) [111.26.79.112]:39034: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.182.242.149
country_id: 3658394
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=9 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.211.85.19
country_id: 1814991
description:
Jan 14 09:20:57 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.211.85.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.211.85.19
country_id: 1814991
description:
2026-01-14 09:20:59 dovecot_login authenticator failed for H=([171.211.123.106]) [171.211.85.19]:49050: 535 Incorrect authentication data (set_id=nicholas@eminent.st)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.50.210
country_id: 6252001
description:
[2026-01-14 09:28:37 +0800] info [webmaild] 45.3.50.210 - kitty.yap@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.195.205.39
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=456483 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.184.73.135
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603871 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.21.2.127
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/Ablewell.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 09:39:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61532: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 09:39:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61533: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 124.82.22.71
country_id: 1733045
description:
[2026-01-14 09:45:43 +0800] info [webmaild] 124.82.22.71 - aoto@aoto.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.0.26.214
country_id: 3469034
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-70.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.60.144.238
country_id: 895949
description:
2026-01-14 09:45:55 dovecot_login authenticator failed for H=([41.60.144.238]) [41.60.144.238]:51165: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 09:48:10 H=([45.144.212.242]) [45.144.212.242]:53978 F=<no_reply@admin.com> rejected RCPT <emma@agsaintifik.com.my>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 42.191.134.208
country_id: 1733045
description:
[2026-01-14 09:50:45 +0800] info [webmaild] 42.191.134.208 - wongss28@fkr.com.my "POST /cpsess2735505769/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [60.54.14.133] != Current IP Address [42.191.134.208]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.149.103
country_id: 3469034
description:
2026-01-14 09:53:28 dovecot_login authenticator failed for H=(213.5.130.152) [170.233.149.103]:55708: 535 Incorrect authentication data (set_id=nurhayat@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.205.226
country_id: 192950
description:
2026-01-14 09:54:18 dovecot_login authenticator failed for H=(213.5.130.182) [41.72.205.226]:50606: 535 Incorrect authentication data (set_id=hadzrizan@manforce.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-14 09:57:22 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 09:57:59 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58165: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 09:58:11 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58174: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 09:59:10 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58191: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 10:01:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58256: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.0.83.168
country_id: 1562822
description:
Jan 14 10:01:13 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.0.83.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 10:01:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58262: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.0.83.168
country_id: 1562822
description:
2026-01-14 10:01:15 dovecot_login authenticator failed for H=([127.0.0.1]) [117.0.83.168]:47088: 535 Incorrect authentication data (set_id=rina@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.101
country_id: 3175395
description:
Jan 14 10:02:28 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.101 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.238.251.212
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-03.77.238.251.212||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 42.191.134.208
country_id: 1733045
description:
[2026-01-14 10:04:37 +0800] info [webmaild] 42.191.134.208 - zawir@fkr.com.my "POST /cpsess1504721562/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 10:05:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64738: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-14 10:05:06 +0800] info [webmaild] 113.211.37.45 - chuan@tschuan.com "GET /cpsess1655842472/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 10:05:11 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64738: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 10:07:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61612: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 10:07:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61614: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.182.117
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-08.171.236.182.117||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2026-01-14 10:10:02 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:34782: 535 Incorrect authentication data (set_id=wgoeqsscr@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.23.72.121
country_id: 6252001
description:
Jan 14 10:10:00 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.23.72.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.160.131.100
country_id: 1814991
description:
Jan 14 10:11:25 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.160.131.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.160.131.100
country_id: 1814991
description:
2026-01-14 10:11:27 dovecot_login authenticator failed for H=([117.160.131.100]) [117.160.131.100]:38723: 535 Incorrect authentication data (set_id=wgoeqsscr)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.21.234.75
country_id: 1562822
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/iso-1.jpeg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 10:13:07 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64899: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 10:13:13 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64899: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 113.211.214.9
country_id: 1733045
description:
113.211.214.9 - - [14/Jan/2026:10:15:11 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248787&pdata=https%253A%252F%252Fwww.lvconsult.com.my%253A2096%252Fcpsess7892333628%252F3rdparty%252Froundcube%252F%253F_task%253Dmail%2526_mbox%253DINBOX&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768356910 HTTP/2.0" 302 0 www.lvconsult.com.my "https://www.lvconsult.com.my:2096/cpsess7892333628/3rdparty/roundcube/?_task=mail&_mbox=INBOX" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 Edg/143.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:113.211.214.9


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.245.229.205
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=93521515121133 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 113.211.214.9
country_id: 1733045
description:
113.211.214.9 - - [14/Jan/2026:10:16:51 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6513557&pdata=http%253A%252F%252Flvconsult.com.my%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768357010 HTTP/1.1" 302 0 lvconsult.com.my "http://lvconsult.com.my:2095/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:113.211.214.9


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-14 10:20:11 H=(localhost.localdomain) [78.153.140.207]:45246 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 67.227.121.154
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-21.67.227.121.154||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.9
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/log/anaconda/hawkey.log||User:root||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 10:26:50 H=([45.144.212.242]) [45.144.212.242]:52904 F=<kamal@sunnyseafoodtrade.com> rejected RCPT <asttwu@astlog.com.my>: No Such User Here


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 10:29:34 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:65242: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.225.227.251
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/myclabs/deep-copy/fixtures/f003 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.248.69.213
country_id: 2017370
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/myclabs/deep-copy/fixtures/f003/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 10:35:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61698: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.201.254.29
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/app/Http/Requests/Admin/UpdateAppointmentsRequest.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.170.104
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-35.171.236.170.104||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.58.24.237
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-35.31.58.24.237||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 10:35:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61698: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.96.73.113
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=80511516688786 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.125.243.161
country_id: 2635167
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/6656708877.jpg&size=262*388 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.232.201.188
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=464199 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.238.251.212
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-45.77.238.251.212||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.137.8
country_id: 1733045
description:
[2026-01-14 10:46:12 +0800] info [webmaild] 113.211.137.8 - felicia@nexuscollection.com "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.203
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/local/apache/conf/httpd.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.191.134.208
country_id: 1733045
description:
[2026-01-14 10:47:39 +0800] info [webmaild] 42.191.134.208 - nazurah@fkr.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 10:57:33 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:49246: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.188
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/animate/animate.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.200
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/css/theme.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.84.52.82
country_id: 3469034
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/product-detail.php?id=772257 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.240
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/font-awesome/css/fontawesome-all.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.221
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/bootstrap/css/bootstrap.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.227
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/css/custom.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.198
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/font-awesome/webfonts/fa-solid-900.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.181
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/font-awesome/webfonts/fa-brands-400.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.213
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/magnific-popup/magnific-popup.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.167
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/css/theme-elements.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.184
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/owl.carousel/assets/owl.theme.default.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.224
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/owl.carousel/assets/owl.carousel.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.203
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/linear-icons/css/linear-icons.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.138
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/linear-icons/fonts/Linearicons-Free54e9.woff2?w118d HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.163.204
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-78.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 11:02:46 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 11:03:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61773: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 11:03:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61773: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.107.227.250
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/console/Formatter/OutputFormatterInterface.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 204.124.3.67
country_id: 6252001
domain: vmsmotorsports.com.my
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 12; SM-G990U2 Build/SP1A.210812.016; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023109030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/31.9.3 ByteLocale/en ByteFullLocale/en Region/JM AppId/1233 Spark/1.4.3.5-bugfix AppVersion/31.9.3 BytedanceWebview/d8a21c6||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 11:07:19 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-14 11:07:34 H=(localhost.localdomain) [78.153.140.207]:59850 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 184.174.43.27
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-07.184.174.43.27||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.3.66
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-10.206.232.3.66||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.80.185
country_id: 690791
description:
Jan 14 11:12:43 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.80.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.80.185
country_id: 690791
description:
2026-01-14 11:12:45 dovecot_plain authenticator failed for H=(preingly) [178.16.80.185]:36774: 535 Incorrect authentication data (set_id=suetyee.chang@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.68.37.25
country_id: 2661886
description:
Jan 14 11:18:20 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.68.37.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.7.42.225
country_id: 2017370
description:
2026-01-14 11:20:44 dovecot_login authenticator failed for H=([185.7.42.225]) [185.7.42.225]:36574: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.7.42.225
country_id: 2017370
description:
Jan 14 11:20:42 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.7.42.225 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.8.141.2
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/event-dispatcher-contracts/LICENSE HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 11:25:07 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:49529: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 11:25:13 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:49529: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.4
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/self/root/etc/stats.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 204.157.178.190
country_id: 99237
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=4 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.51.60.152
country_id: 3585968
domain: fimco.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fimco.com.my/cgi-bin HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.235.55.168
country_id: 3469034
domain: fimco.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fimco.com.my/cgi-bin/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.80.78.5
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/14excel5.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.23.112.225
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/swiftmailer/swiftmailer/lib/preferences.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.246.38.42
country_id: 3996063
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/Furnotel.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 11:37:31 H=([45.144.212.242]) [45.144.212.242]:56327 F=<no_reply@admin.com> rejected RCPT <enquiry@smartcable.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.120.132.236
country_id: 1831722
description:
Jan 14 11:39:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.120.132.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.132.236
country_id: 1831722
description:
2026-01-14 11:39:20 dovecot_plain authenticator failed for H=(1mtadxd3yvey24u6yl) [103.120.132.236]:58131: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


