# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 15 06:08:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-15 06:08:53 dovecot_login authenticator failed for H=(QL6xMsm) [178.16.54.138]:58999: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-15 06:09:17 dovecot_login authenticator failed for H=(7nf5Pm17B) [178.16.54.138]:61535: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 15 06:09:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.13.163.217
country_id: 1814991
description:
Jan 15 06:10:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.13.163.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.163.217
country_id: 1814991
description:
2026-01-15 06:10:35 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.163.217]:40354: 535 Incorrect authentication data (set_id=jessie@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.227.65.179
country_id: 3469034
description:
Jan 15 06:10:42 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.227.65.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.136
country_id: 933860
description:
Jan 15 06:10:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 15 06:10:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-15 06:10:30 dovecot_login authenticator failed for H=(vpQrgRu9S) [178.16.54.138]:50913: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 15 06:11:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-15 06:11:16 dovecot_login authenticator failed for H=(KgYl1X) [178.16.54.138]:52141: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.166
country_id: 3865483
description:
Jan 15 06:11:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 15 06:12:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-15 06:12:27 dovecot_login authenticator failed for H=(J7QqtHPh) [178.16.54.138]:56821: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 15 06:13:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-15 06:13:37 dovecot_login authenticator failed for H=(8GHtk1sa) [178.16.54.138]:61858: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.84.54
country_id: 1269750
description:
Jan 15 06:14:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.84.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.84.54
country_id: 1269750
description:
2026-01-15 06:14:35 dovecot_login authenticator failed for H=([182.79.151.121]) [27.123.84.54]:50898: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 15 06:14:44 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-15 06:14:46 dovecot_login authenticator failed for H=(rqRtFE5) [178.16.54.138]:64537: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 15 06:15:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-15 06:15:10 dovecot_login authenticator failed for H=(rwzNTG) [178.16.54.138]:50553: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 145.239.232.39
country_id: 3017382
domain: eminent.st
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.63||T:APACHE||REQUEST_URI:/wp-content/plugins/woocommerce/readme.txt||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
country_id: 6252001
description:
Jan 15 06:16:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 15 06:16:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-15 06:16:20 dovecot_plain authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net (paring) [71.62.34.216]:42842: 535 Incorrect authentication data (set_id=info@printspecsolution.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-15 06:16:22 dovecot_login authenticator failed for H=(yQK3Nq) [178.16.54.138]:54034: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-15 06:17:11 dovecot_login authenticator failed for H=(F5FdQN1r0E) [178.16.54.138]:64288: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 15 06:17:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 15 06:18:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.140.176.124
country_id: 2510769
description:
Jan 15 06:18:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.140.176.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-15 06:18:21 dovecot_login authenticator failed for H=(EQHmAkRR) [178.16.54.138]:64304: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.217.112.99
country_id: 798544
description:
Jan 15 06:18:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.217.112.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-15 06:19:09 dovecot_login authenticator failed for H=(rH11Tz9eHh) [178.16.54.138]:64033: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 15 06:19:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 15 06:20:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-15 06:20:21 dovecot_login authenticator failed for H=(vs5HbS) [178.16.54.138]:61395: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-15 06:21:10 dovecot_login authenticator failed for H=(BkOmPAA) [178.16.54.138]:56515: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 15 06:21:31 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 15 06:22:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-15 06:22:19 dovecot_login authenticator failed for H=(zzsLUn71i) [178.16.54.138]:58822: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-15 06:23:27 dovecot_login authenticator failed for H=(LQEOWyEE) [178.16.54.138]:63016: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.152
country_id: 3703430
description:
Jan 15 06:23:51 sv3 pure-ftpd[2804077]: (?@45.227.254.152) [INFO] New connection from 45.227.254.152


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 15 06:23:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 15 06:24:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-15 06:24:14 dovecot_login authenticator failed for H=(VIQmo2GZ) [178.16.54.138]:53544: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.167.223.128
country_id: 102358
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/work/13/52/1353853 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.147.221.152
country_id: 1814991
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/side.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 114.234.230.185
country_id: 1814991
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/content.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.184.4.95
country_id: 1814991
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/custom.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 15 06:25:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-15 06:25:25 dovecot_login authenticator failed for H=(ZQJESU3UGS) [178.16.54.138]:56353: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.34.161.238
country_id: 2017370
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/guzzlehttp/psr7/src/StreamDecoratorTrait.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 15 06:26:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-15 06:26:11 dovecot_login authenticator failed for H=(gJnDSCL) [178.16.54.138]:59677: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.121.76.169
country_id: 732800
description:
Jan 15 06:26:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.121.76.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.143.59.184
country_id: 6252001
description:
2026-01-15 06:26:33 dovecot_login authenticator failed for H=([166.143.59.184]) [166.143.59.184]:20672: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.22.233.202
country_id: 3175395
description:
Jan 15 06:28:44 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.22.233.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.0.249.148
country_id: 3469034
description:
Jan 15 06:28:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.0.249.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.19
country_id: 953987
description:
Jan 15 06:31:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.31
country_id: 3469034
description:
Jan 15 06:34:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.31 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.117.136.118
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/schema HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.131.139.232
country_id: 3658394
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/schema/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.31
country_id: 3469034
description:
Jan 15 06:34:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.83
country_id: 690791
description:
Jan 15 06:34:26 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.51
country_id: 953987
description:
Jan 15 06:35:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.171.78.101
country_id: 3686110
description:
Jan 15 06:37:44 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.171.78.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.33
country_id: 798544
description:
Jan 15 06:38:42 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.41
country_id: 3175395
description:
Jan 15 06:39:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.41
country_id: 3175395
description:
Jan 15 06:39:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.147
country_id: 6252001
description:
Jan 15 06:39:57 sv3 pure-ftpd[2812426]: (?@91.230.168.147) [INFO] New connection from 91.230.168.147


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.151
country_id: 6252001
description:
Jan 15 06:39:57 sv3 pure-ftpd[2812424]: (?@91.230.168.151) [INFO] New connection from 91.230.168.151


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.203.117
country_id: 1522867
description:
2026-01-15 06:42:03 dovecot_login authenticator failed for H=(2-74-203-117.kcell.kz) [2.74.203.117]:39389: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.254.23.84
country_id: 2921044
description:
[2026-01-15 06:43:06 +0800] info [webmaild] 5.254.23.84 - prayerlink@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 161.142.150.207
country_id: 1733045
description:
161.142.150.207 - - [15/Jan/2026:06:42:35 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250643&pdata=https%253A%252F%252Fmckd.com.my%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768430553 HTTP/2.0" 302 0 mckd.com.my "https://mckd.com.my:2096/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.2 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:161.142.150.207


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.227.99.87
country_id: 1668284
description:
Jan 15 06:44:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.227.99.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.227.99.87
country_id: 1668284
description:
Jan 15 06:44:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.227.99.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.135.156
country_id: 6290252
description:
Jan 15 06:46:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.135.156 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.224.101
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-84.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 06:48:42 H=([45.144.212.242]) [45.144.212.242]:65327 F=<no_reply@admin.com> rejected RCPT <sales@chs.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 06:50:59 H=([45.144.212.242]) [45.144.212.242]:64684 F=<no_reply@admin.com> rejected RCPT <info@pspoly.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.255.0.26
country_id: 3469034
description:
Jan 15 06:52:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.255.0.26 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.236.28.86
country_id: 3625428
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/1475280832.jpg&size=1000x1000 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.255.0.26
country_id: 3469034
description:
Jan 15 06:52:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.255.0.26 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.176.126.241
country_id: 1562822
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/Qware.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.101.136.23
country_id: 2542007
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/SylkReader.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.176
country_id: 3469034
description:
Jan 15 06:54:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 06:54:26 H=([45.144.212.242]) [45.144.212.242]:62801 F=<no_reply@admin.com> rejected RCPT <info@pftfood.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.10
country_id: 3469034
description:
Jan 15 06:54:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.28.53.18
country_id: 690791
description:
Jan 15 06:54:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.28.53.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.176
country_id: 3469034
description:
Jan 15 06:54:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.28.53.18
country_id: 690791
description:
Jan 15 06:55:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.28.53.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 06:56:15 H=([45.144.212.242]) [45.144.212.242]:52397 F=<no_reply@admin.com> rejected RCPT <support@langkawiconstructions.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.41.222
country_id: 953987
description:
Jan 15 06:56:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.41.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.163
country_id: 953987
description:
Jan 15 06:56:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.120.171
country_id: 798544
description:
Jan 15 06:57:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.120.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.132.130
country_id: 1269750
description:
Jan 15 06:57:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.132.130 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.9.192
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/homeabout.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.103.30.205
country_id: 3625428
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.117.185.114
country_id: 2017370
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/logo_reward4.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.120.253.174
country_id: 3625428
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/logo_reward1.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.24.61.193
country_id: 99237
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/banner4.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.150.90.194
country_id: 3996063
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/banner2.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.88
country_id: 6252001
description:
Jan 15 07:03:12 sv3 pure-ftpd[2824923]: (?@147.185.132.88) [INFO] New connection from 147.185.132.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.41.2.235
country_id: 3625428
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/logo.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.56.86.29
country_id: 3439705
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/sirim.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.253.2.90
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/resource/product2.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.121.113.24
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/logo_reward6.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.95.200.180
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/css/owl.carousel.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.181.133.231
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/cat3.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.197.58.148
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/banner3.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.94.113
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/css/colors/colors.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.172.249.84
country_id: 614540
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/logo_reward5.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.16.49
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/cat1.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.114.43.163
country_id: 3895114
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/logo_reward2.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.61.12.181
country_id: 285570
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/?m=pc&a=page_p_search_name HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.184.56.46
country_id: 6254930
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/cat2.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.156.125.194
country_id: 3686110
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/css/style.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.28.136.22
country_id: 248816
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/depositphotos_48742859-stock-photo-bikers-tour-along-europe1.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.220.37.179
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/up.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.53.192.102
country_id: 102358
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/stock-photo-high-speed-driving-on-the-motorcycle-on-wet-asphalt-3145125351.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.182.178.78
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/resource/maxresdefault.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.219.249.16
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/depositphotos_9320285-stock-photo-bikes1.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.73.85.41
country_id: 3625428
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/banner1.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.115.171.12
country_id: 3923057
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/js/skins/default/lightbox-next.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.254.139.17
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/images/47045885-close-up-of-a-high-power-motorcycle-classic-vintage-style-1.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.120.32.100
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/js/skins/default/lightbox-close.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.63.83
country_id: 1814991
description:
Jan 15 07:06:45 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.63.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.83
country_id: 1814991
description:
2026-01-15 07:06:47 dovecot_login authenticator failed for H=([111.26.63.82]) [111.26.63.83]:48266: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.16.123
country_id: 2300660
description:
Jan 15 07:06:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.16.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.163.189.191
country_id: 2017370
description:
Jan 15 07:07:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.163.189.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.189.191
country_id: 2017370
description:
2026-01-15 07:07:32 dovecot_login authenticator failed for H=([46.163.189.191]) [46.163.189.191]:55510: 535 Incorrect authentication data (set_id=nicholas@eminent.st)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.133.72
country_id: 3175395
description:
Jan 15 07:11:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.133.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.94
country_id: 3865483
description:
Jan 15 07:11:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 07:14:03 H=([45.144.212.242]) [45.144.212.242]:52477 F=<no_reply@admin.com> rejected RCPT <info@sutsb.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.179.84
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-61.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.13.140
country_id: 3469034
description:
Jan 15 07:20:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.13.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.13.140
country_id: 3469034
description:
Jan 15 07:20:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.13.140 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 161.142.139.200
country_id: 1733045
description:
161.142.139.200 - - [15/Jan/2026:07:22:56 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251667&pdata=https%253A%252F%252Flnlfireprotection.com%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768432973 HTTP/2.0" 302 0 lnlfireprotection.com "https://lnlfireprotection.com:2096/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:161.142.139.200


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.208.80
country_id: 798544
description:
Jan 15 07:22:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.208.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.139.200
country_id: 1733045
description:
[2026-01-15 07:25:32 +0800] info [webmaild] 161.142.139.200 - csl@lnlfireprotection.com "GET /cpsess5250311459/horde/imp/dynamic.php?page=mailbox HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.172
country_id: 3469034
description:
Jan 15 07:25:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.113.225
country_id: 3469034
description:
Jan 15 07:25:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.113.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 07:26:36 H=([45.144.212.242]) [45.144.212.242]:62587 F=<no_reply@admin.com> rejected RCPT <sales@hmz.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.172
country_id: 3469034
description:
Jan 15 07:26:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.172 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.72.9
country_id: 1512440
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/training-details.php?id=243858 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.215.15.2
country_id: 192950
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/tired/10/21/1017709 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.0.146.73
country_id: 3469034
domain: www.symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.symphony-led.com/products/media-facade/outdoor-led-screen-d6-series/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.67
country_id: 798544
description:
Jan 15 07:29:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.122.203
country_id: 3469034
description:
Jan 15 07:29:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.122.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.209.183
country_id: 798544
description:
Jan 15 07:29:40 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.209.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.248.149.21
country_id: 3175395
description:
Jan 15 07:29:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.248.149.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.248.149.21
country_id: 3175395
description:
Jan 15 07:30:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.248.149.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.171.68
country_id: 732800
description:
Jan 15 07:30:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.171.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.133.19
country_id: 3175395
description:
Jan 15 07:37:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.133.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.53
country_id: 933860
description:
Jan 15 07:37:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 07:38:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.20.58.124
country_id: 798544
description:
Jan 15 07:39:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.20.58.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.151
country_id: 798544
description:
Jan 15 07:39:42 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 07:42:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.189.16.115
country_id: 337996
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/foot/422/422532 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 174.138.40.132
country_id: 6252001
domain: af-sb.com
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.126.110.202
country_id: 99237
description:
Jan 15 07:45:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.126.110.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.199.29.4
country_id: 798544
description:
Jan 15 07:45:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.199.29.4 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.74.221.229
country_id: 1733045
description:
[2026-01-15 07:51:28 +0800] info [webmaild] 180.74.221.229 - eesabah@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.189.153.249
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/File/MimeType HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.84.62.247
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/File/MimeType/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.243.129
country_id: 3469034
description:
Jan 15 07:55:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.243.129 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 34.176.230.169
country_id: 3895114
domain: aircarbonic.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.63||T:APACHE||RA:34.176.230.169||TA:34.176.230.169||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.201.31
country_id: 2413451
description:
2026-01-15 07:59:37 dovecot_plain authenticator failed for H=(z37vj5m1zhfgpijifyja5) [197.255.201.31]:43812: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.204.212.179
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=803239 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.35.36
country_id: 953987
description:
Jan 15 08:04:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.35.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.189
country_id: 3175395
description:
Jan 15 08:05:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.80
country_id: 3469034
description:
Jan 15 08:04:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.80 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.253.212.33
country_id: 6251999
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-04.104.253.212.33||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.35.36
country_id: 953987
description:
Jan 15 08:04:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.35.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.40
country_id: 3057568
description:
Jan 15 08:04:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.189
country_id: 3175395
description:
Jan 15 08:05:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.244.17.96
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-52.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-15 08:06:35 +0800] info [webmaild] 115.134.149.232 - pr@smartcable.com.my "GET /cpsess9084765842/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.157
country_id: 1835841
description:
2026-01-15 08:08:20 dovecot_login authenticator failed for H=([121.131.220.157]) [121.131.220.157]:44215: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.112.106.236
country_id: 3175395
description:
Jan 15 08:09:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.112.106.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.112.106.236
country_id: 3175395
description:
Jan 15 08:09:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.112.106.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.227.187.43
country_id: 3865483
description:
Jan 15 08:09:26 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.227.187.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
country_id: 1814991
description:
Jan 15 08:09:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2026-01-15 08:09:58 dovecot_login authenticator failed for H=([182.42.113.10]) [182.42.113.10]:35964: 535 Incorrect authentication data (set_id=ratanam@maalloys.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.173.158.60
country_id: 3469034
domain: www.ahfengineering.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahfengineering.com/cgi-bin HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.26
country_id: 1269750
description:
Jan 15 08:10:40 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.204.134.124
country_id: 6252001
description:
Jan 15 08:12:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.204.134.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-15 08:12:04 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (nougheming) [98.204.134.124]:50598: 535 Incorrect authentication data (set_id=wilson.wong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.203
country_id: 2300660
description:
Jan 15 08:14:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.203 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.239.206.46
country_id: 3469034
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/p-1.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.183
country_id: 953987
description:
Jan 15 08:14:44 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.183 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.238.162.28
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/resources/views/partials/topbar.blade.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/img/photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.25
country_id: 6252001
description:
2026-01-15  8:20:31 86964 [Warning] Aborted connection 86964 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.25' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 08:20:56 H=([45.144.212.242]) [45.144.212.242]:55390 F=<no_reply@admin.com> rejected RCPT <inquiries@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.89
country_id: 3865483
description:
Jan 15 08:21:26 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.198.4.133
country_id: 2017370
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/Cambro.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-15 08:24:01 +0800] info [webmaild] 203.106.96.63 - jefflee@sutsb.com.my "POST /cpsess5190256978/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [60.53.110.66] != Current IP Address [203.106.96.63]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.248
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/css/skins/default.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.178.71
country_id: 3175395
description:
Jan 15 08:25:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.178.71 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.56.180.157
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/about.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.79
country_id: 3175395
description:
Jan 15 08:27:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.150
country_id: 3175395
description:
Jan 15 08:27:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.23.204.74
country_id: 1269750
description:
Jan 15 08:28:49 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.23.204.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.74
country_id: 1269750
description:
2026-01-15 08:28:51 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-097.37.23.125.airtelbroadband.in) [125.23.204.74]:35476: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.28.214
country_id: 933860
description:
Jan 15 08:28:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.28.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.187
country_id: 3175395
description:
Jan 15 08:28:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.187 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-15 08:29:54 +0800] info [webmaild] 203.106.96.63 - muslihin@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [60.53.110.66] != Current IP Address [203.106.96.63]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/csr.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 08:33:23 H=([45.144.212.242]) [45.144.212.242]:64304 F=<no_reply@admin.com> rejected RCPT <julie@nobledec.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.80.53
country_id: 1512440
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/just/11/659/1169937 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 08:35:37 H=([45.144.212.242]) [45.144.212.242]:65412 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/img/photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.78.183
country_id: 1562822
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/Cambro.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.51
country_id: 298795
description:
Jan 15 08:36:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.32.43
country_id: 798544
description:
Jan 15 08:41:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.32.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.114.89.9
country_id: 798544
description:
Jan 15 08:40:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.114.89.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 08:40:41 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:65452: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.32.43
country_id: 798544
description:
Jan 15 08:41:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.32.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.15.203
country_id: 3469034
description:
Jan 15 08:41:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.15.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.34
country_id: 953987
description:
Jan 15 08:41:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 08:42:07 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50377: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 08:42:13 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50377: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.34
country_id: 953987
description:
Jan 15 08:42:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.162.164.123
country_id: 1562822
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/Menu Master.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.126
country_id: 3469034
description:
Jan 15 08:43:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 08:44:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50409: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.196.161.232
country_id: 2510769
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-44.109.196.161.232||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.71.200.162
country_id: 6252001
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/shop-single.php?id=6921 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 08:44:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50411: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.136
country_id: 2510769
description:
Jan 15 08:46:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 08:48:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:54161: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 08:48:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:54162: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.55.147
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-49.142.111.55.147||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-15 08:51:00 +0800] info [webmaild] 203.106.96.63 - hilmi.husni@sutsb.com.my "GET /cpsess6861267232/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [60.53.110.66] != Current IP Address [203.106.96.63]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.185.159
country_id: 3469034
description:
Jan 15 08:54:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.185.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.185.159
country_id: 3469034
description:
Jan 15 08:54:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.185.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 08:56:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55929: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 08:56:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55929: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.68
country_id: 3175395
description:
Jan 15 08:57:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.56
country_id: 953987
description:
Jan 15 08:57:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.86
country_id: 3865483
description:
Jan 15 08:57:52 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.68
country_id: 3175395
description:
Jan 15 08:57:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.237
country_id: 3469034
description:
Jan 15 08:57:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.234.147.45
country_id: 953987
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/welding.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-15 09:00:39 +0800] info [webmaild] 175.144.229.115 - claimservice@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 09:03:44 H=([45.144.212.242]) [45.144.212.242]:54094 F=<no_reply@admin.com> rejected RCPT <tst@tst-ma.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.88
country_id: 2510769
description:
Jan 15 09:03:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.91.52
country_id: 1562822
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/wall/13/1318444 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.126
country_id: 3469034
description:
Jan 15 09:06:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.34
country_id: 3469034
description:
Jan 15 09:07:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.255.64.156
country_id: 458258
description:
Jan 15 09:06:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.255.64.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.34
country_id: 3469034
description:
Jan 15 09:07:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.21.6
country_id: 2300660
description:
Jan 15 09:07:52 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.21.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-15 09:08:12 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:38332: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.216.145
country_id: 99237
description:
Jan 15 09:08:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.216.145 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.252.36.11
country_id: 1562822
domain: ms-chemicals.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ms-chemicals.net/wp-content/uploads/slide01.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.47.172.253
country_id: 2287781
description:
Jan 15 09:08:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.47.172.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.62.236.44
country_id: 732800
description:
Jan 15 09:10:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.62.236.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.143
country_id: 732800
description:
Jan 15 09:10:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.143 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/10anniversary.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.62.236.44
country_id: 732800
description:
Jan 15 09:10:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.62.236.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-15 09:11:58 +0800] info [webmaild] 113.211.37.45 - chuan@tschuan.com "GET /cpsess1903874427/3rdparty/roundcube/?_task=mail&_mbox=INBOX.spam HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 09:12:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59245: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 09:12:17 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59246: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 170.199.228.228
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-13.170.199.228.228||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-15 09:13:52 +0800] info [webmaild] 175.144.229.115 - admin@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/img/druma_photos/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/img/druma_photos/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.170
country_id: 1269750
description:
2026-01-15 09:23:55 dovecot_login authenticator failed for H=([182.95.52.170]) [182.95.52.170]:52802: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.52.170
country_id: 1269750
description:
Jan 15 09:23:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.52.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.222.93.199
country_id: 6252001
description:
Jan 15 09:26:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.222.93.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2026-01-15 09:26:29 dovecot_plain authenticator failed for H=c-98-222-93-199.hsd1.il.comcast.net (ormakermo) [98.222.93.199]:50588: 535 Incorrect authentication data (set_id=tom.cheong@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.195.239.119
country_id: 1819730
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/rainbow/209/226741 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.179.61
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-21.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.249.158
country_id: 3865483
description:
Jan 15 09:30:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.249.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.47.172.253
country_id: 2287781
description:
Jan 15 09:29:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.47.172.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-15 09:29:36 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:56158: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.249.158
country_id: 3865483
description:
Jan 15 09:30:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.249.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.253.45.105
country_id: 3469034
description:
Jan 15 09:30:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.253.45.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 09:30:46 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.196.87.135
country_id: 3469034
description:
Jan 15 09:33:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.196.87.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.196.87.135
country_id: 3469034
description:
Jan 15 09:34:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.196.87.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 09:35:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-15 09:36:41 H=([45.144.212.54]) [45.144.212.54]:52212 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.65.142.78
country_id: 798544
description:
Jan 15 09:36:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.65.142.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 09:37:59 H=([45.144.212.242]) [45.144.212.242]:60712 F=<no_reply@admin.com> rejected RCPT <joseph@symphony-led.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.31
country_id: 3175395
description:
Jan 15 09:37:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.31
country_id: 3175395
description:
Jan 15 09:38:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 09:40:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59380: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.208.171
country_id: 798544
description:
Jan 15 09:40:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.208.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 09:40:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59381: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.135
country_id: 953987
description:
Jan 15 09:41:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.194
country_id: 2395170
description:
Jan 15 09:41:40 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.194 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/component/tag/images/img/druma_photos/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 89.163.153.108
country_id: 2921044
domain: www.dsc-expat.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.dynamicsolutionsconsultancy.com||User:dscexpat||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.171
country_id: 3469034
description:
Jan 15 09:45:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.230
country_id: 298795
description:
Jan 15 09:45:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.81.153.60
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/images/trophy-2.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/private-residence.php||SC:/home/indfinitydesign/public_html/images/private-residence.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 176.98.232.159
country_id: 1522867
description:
2026-01-15 09:51:09 H=([176.98.232.159]) [176.98.232.159]:61133 F=<dse_na3@docusign.net> rejected RCPT <astpkg@astlog.com.my>: SPF: 176.98.232.159 is not allowed to send mail from docusign.net


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.201
country_id: 3469034
description:
Jan 15 09:56:42 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.201 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.2.100.141
country_id: 1643084
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-13.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.213
country_id: 3865483
description:
Jan 15 09:56:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.166
country_id: 3469034
description:
Jan 15 09:57:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.189.164.202
country_id: 1861060
description:
2026-01-15 09:58:49 dovecot_plain authenticator failed for H=softbank111189164202.bbtec.net (smtpclient.apple) [111.189.164.202]:30495: 535 Incorrect authentication data (set_id=iwata@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.75.218
country_id: 1269750
description:
Jan 15 09:59:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.75.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.50.35.84
country_id: 1733045
description:
[2026-01-15 10:00:34 +0800] info [webmaild] 60.50.35.84 - pylim@af-sb.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.90.234.83
country_id: 3469034
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-82.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.48
country_id: 3865483
description:
Jan 15 10:06:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-15 10:06:26 H=(localhost.localdomain) [78.153.140.207]:56142 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 10:08:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59480: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.232.165.174
country_id: 798544
description:
Jan 15 10:07:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.232.165.174 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/es/images/press.php||SC:/home/indfinitydesign/public_html/es||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.170.240
country_id: 3469034
description:
Jan 15 10:07:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.170.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.3
country_id: 3175395
description:
Jan 15 10:07:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 10:08:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59480: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.67
country_id: 99237
description:
Jan 15 10:08:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2026-01-15 10:08:31 dovecot_plain authenticator failed for H=(deushees) [65.20.129.67]:45252: 535 Incorrect authentication data (set_id=support@fimco.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.34.30.15
country_id: 3175395
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/vegetable/365/566695 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.247.169.77
country_id: 2510769
description:
Jan 15 10:11:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.247.169.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.247.169.77
country_id: 2510769
description:
Jan 15 10:11:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.247.169.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.207
country_id: 732800
description:
Jan 15 10:15:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-15 10:16:31 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.42
country_id: 3469034
description:
Jan 15 10:16:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.86.221.69
country_id: 2017370
description:
Jan 15 10:16:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.86.221.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.86.221.69
country_id: 2017370
description:
2026-01-15 10:17:01 dovecot_login authenticator failed for H=([88.86.221.69]) [88.86.221.69]:50208: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-15 10:18:00 H=(localhost.localdomain) [78.153.140.207]:44088 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 10:20:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56228: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.53.11
country_id: 1835841
description:
2026-01-15 10:20:05 dovecot_login authenticator failed for H=([168.126.53.11]) [168.126.53.11]:37818: 535 Incorrect authentication data (set_id=info@imax.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.126.53.11
country_id: 1835841
description:
Jan 15 10:20:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.126.53.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 10:20:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56228: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 10:22:56 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56334: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 10:23:14 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56339: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.105.233
country_id: 3469034
description:
Jan 15 10:24:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.105.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 10:24:27 H=([45.144.212.242]) [45.144.212.242]:60948 F=<no_reply@admin.com> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 213.168.250.151
country_id: 2635167
domain: www.nobledec.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:id||MV:\"/><script>alert(\"xss\")</script>||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 213.168.250.151
country_id: 2635167
domain: www.nobledec.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:\"/><script>alert(\"XSS\")</script>||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.150
country_id: 690791
description:
Jan 15 10:24:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 10:25:46 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56392: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.115
country_id: 3469034
description:
Jan 15 10:26:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.140
country_id: 690791
description:
Jan 15 10:26:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.61.142.172
country_id: 2510769
description:
Jan 15 10:26:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.61.142.172 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-15 10:26:35 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.108
country_id: 3865483
description:
Jan 15 10:26:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.66
country_id: 933860
description:
Jan 15 10:26:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.172.221.171
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-27.107.172.221.171||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2026-01-15 10:27:56 dovecot_login authenticator failed for H=([45.82.109.136]) [45.82.109.136]:60630: 535 Incorrect authentication data (set_id=salesmp@aoto.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.66
country_id: 933860
description:
Jan 15 10:27:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 10:33:03 H=([45.144.212.242]) [45.144.212.242]:61897 F=<no_reply@admin.com> rejected RCPT <inquiries@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 122.114.11.23
country_id: 1814991
description:
2026-01-15 10:35:07 H=(localhost.localdomain) [122.114.11.23]:60720 F=<feedback@service.aIibaba.com> rejected RCPT <sales@acburn.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 10:36:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59765: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 10:36:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56418: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.72.216
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-35.142.111.72.216||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.2.46.159
country_id: 1643084
description:
Jan 15 10:37:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.2.46.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 10:36:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56418: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 10:36:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59768: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.85
country_id: 933860
description:
Jan 15 10:36:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.85 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.118.85.23
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=74851515726086 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.2.46.159
country_id: 1643084
description:
Jan 15 10:37:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.2.46.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.85
country_id: 933860
description:
Jan 15 10:37:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.85 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 223.197.201.128
country_id: 1819730
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/pcp/derived/proc.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.105
country_id: 3469034
description:
Jan 15 10:37:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 10:39:32 H=([45.144.212.242]) [45.144.212.242]:61757 F=<no_reply@admin.com> rejected RCPT <julie@nobledec.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.168.9.94
country_id: 3996063
description:
Jan 15 10:40:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.168.9.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.211
country_id: 1269750
description:
Jan 15 10:40:44 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 10:40:52 H=([45.144.212.242]) [45.144.212.242]:63023 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.85
country_id: 1269750
description:
Jan 15 10:40:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.85 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.248.126.158
country_id: 192950
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/news/11/1175922 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.93
country_id: 3175395
description:
Jan 15 10:41:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.93
country_id: 3175395
description:
Jan 15 10:42:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.50.148
country_id: 3175395
description:
Jan 15 10:42:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.50.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.78.89.26
country_id: 298795
description:
Jan 15 10:42:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.78.89.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.88
country_id: 3175395
description:
Jan 15 10:42:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.43.9
country_id: 953987
description:
Jan 15 10:42:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.43.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-15 10:43:17 H=([77.83.39.167]) [77.83.39.167]:61003 F=<stevenwelboun@op.pl> rejected RCPT <cky@ahfengineering.com>: SPF: 77.83.39.167 is not allowed to send mail from op.pl


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.106.231.51
country_id: 3469034
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/Hatco.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-15 10:47:12 H=(localhost.localdomain) [78.153.140.207]:45528 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.42
country_id: 6252001
description:
2026-01-15 10:48:10 95603 [Warning] Aborted connection 95603 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.42' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.164.112
country_id: 1814991
description:
2026-01-15 10:51:41 dovecot_login authenticator failed for H=(fooqn) [111.179.164.112]:61848: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.164.112
country_id: 1814991
description:
2026-01-15 10:52:16 dovecot_login authenticator failed for H=(gehdm) [111.179.164.112]:61848: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 10:54:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56470: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.195.23
country_id: 3865483
description:
Jan 15 10:54:40 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.195.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 10:54:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56470: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.249.222
country_id: 3469034
description:
Jan 15 10:54:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.249.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.144.229.115
country_id: 1733045
description:
2026-01-15 10:54:31 dovecot_login authenticator failed for H=(siew-yee.local) [175.144.229.115]:61397: 535 Incorrect authentication data (set_id=accounts@evergrown.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 15 10:56:24 sv3 pure-ftpd[3140910]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.140.218.6
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/roof/13/573/1330790 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 15 10:56:43 sv3 pure-ftpd[3141350]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB1050_PMR_MGM_2026_edm/premier_edm.html uploaded  (46047 bytes, 911.05KB/sec)


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 15 10:56:29 sv3 pure-ftpd[3140910]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.19
country_id: 3469034
description:
Jan 15 10:58:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.111
country_id: 690791
description:
Jan 15 10:58:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.112.108.23
country_id: 3175395
description:
Jan 15 10:59:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.112.108.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.9
country_id: 2395170
description:
Jan 15 10:59:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.9 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 15 11:00:19 sv3 pure-ftpd[3147631]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.234.178.105
country_id: 3469034
description:
Jan 15 11:00:36 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.234.178.105 has been locked due to Imunify RBL


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 15 11:00:17 sv3 pure-ftpd[3140910]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/RHB1050_PMR_MGM_2026_edm/premier_edm.html


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 15 11:00:21 sv3 pure-ftpd[3147631]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB1050_PMR_MGM_2026_edm/premier_edm.html uploaded  (46090 bytes, 1271.86KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.82.66
country_id: 1269750
description:
Jan 15 11:00:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.82.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.82.66
country_id: 1269750
description:
Jan 15 11:01:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.82.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.249.73
country_id: 3469034
description:
Jan 15 11:03:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.249.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.249.73
country_id: 3469034
description:
Jan 15 11:03:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.249.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.22.235.118
country_id: 3175395
description:
Jan 15 11:03:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.22.235.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.136
country_id: 2510769
description:
Jan 15 11:03:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.241
country_id: 1668284
description:
2026-01-15 11:03:44 dovecot_login authenticator failed for H=111-70-23-241.emome-ip.hinet.net [111.70.23.241]:39367: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 11:04:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59914: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 11:04:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59916: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.168.201.198
country_id: 6252001
description:
2026-01-15 11:04:35 dovecot_login authenticator failed for H=([166.168.201.198]) [166.168.201.198]:46041: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.182.31
country_id: 1814991
description:
2026-01-15 11:08:21 dovecot_login authenticator failed for H=(gzehs) [111.179.182.31]:53552: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.182
country_id: 732800
description:
Jan 15 11:09:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.236
country_id: 1668284
description:
Jan 15 11:09:52 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.236
country_id: 1668284
description:
2026-01-15 11:09:54 dovecot_login authenticator failed for H=111-70-23-236.emome-ip.hinet.net [111.70.23.236]:56066: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.182
country_id: 732800
description:
Jan 15 11:09:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.106
country_id: 933860
description:
Jan 15 11:10:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.239.213.201
country_id: 3175395
description:
2026-01-15 11:10:59 dovecot_login authenticator failed for H=2-239-213-201.ip251.fastwebnet.it [2.239.213.201]:38486: 535 Incorrect authentication data (set_id=admin@tujusetia.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.174.61
country_id: 1733045
description:
[2026-01-15 11:10:29 +0800] info [webmaild] 175.139.174.61 - pft_rnd@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.123
country_id: 1269750
description:
Jan 15 11:10:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.141.168
country_id: 1733045
description:
2026-01-15 11:10:13 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [113.211.141.168]:5406: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.11.37
country_id: 3469034
description:
Jan 15 11:10:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.11.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.11.37
country_id: 3469034
description:
Jan 15 11:11:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.11.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.141.168
country_id: 1733045
description:
2026-01-15 11:11:05 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [113.211.141.168]:5414: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.106
country_id: 933860
description:
Jan 15 11:11:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 11:11:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:64292: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.141.168
country_id: 1733045
description:
2026-01-15 11:11:23 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [113.211.141.168]:5419: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 11:14:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:55992: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 11:14:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:55992: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 11:14:27 H=([45.144.212.242]) [45.144.212.242]:63154 F=<no_reply@admin.com> rejected RCPT <joseph@symphony-led.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 126.158.198.197
country_id: 1861060
description:
2026-01-15 11:15:45 dovecot_plain authenticator failed for H=om126158198197.30.openmobile.ne.jp (smtpclient.apple) [126.158.198.197]:40727: 535 Incorrect authentication data (set_id=iwata@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 149.202.48.220
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/img/img/demos/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 11:16:52 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:56326: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.34.70.212
country_id: 1282988
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-59.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.0.235.30
country_id: 6252001
description:
Jan 15 11:17:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.0.235.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2026-01-15 11:17:45 dovecot_plain authenticator failed for H=c-73-0-235-30.hsd1.fl.comcast.net (knothertit) [73.0.235.30]:55656: 535 Incorrect authentication data (set_id=jeffrey.hong@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 11:17:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:56330: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.110.150
country_id: 798544
description:
Jan 15 11:19:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.110.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.12
country_id: 933860
description:
Jan 15 11:19:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 11:19:43 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:58075: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/cert.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-15 11:20:54 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.52.136
country_id: 3469034
description:
Jan 15 11:21:46 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.52.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.172.60
country_id: 798544
description:
Jan 15 11:22:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.172.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.179.182.31
country_id: 1814991
description:
Jan 15 11:22:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.179.182.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.182.31
country_id: 1814991
description:
2026-01-15 11:22:30 dovecot_login authenticator failed for H=(heczb) [111.179.182.31]:61622: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.132.202.50
country_id: 719819
description:
Jan 15 11:22:49 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.132.202.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 11:23:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 11:24:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56501: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.55.50
country_id: 3469034
description:
Jan 15 11:24:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.55.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.55.50
country_id: 3469034
description:
Jan 15 11:24:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.55.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 11:24:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56502: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.4
country_id: 2395170
description:
Jan 15 11:24:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.239.213.201
country_id: 3175395
description:
2026-01-15 11:25:20 dovecot_login authenticator failed for H=2-239-213-201.ip251.fastwebnet.it [2.239.213.201]:24061: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 11:27:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.249.149
country_id: 3865483
description:
Jan 15 11:29:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.249.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.82
country_id: 1269750
description:
Jan 15 11:28:26 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.82 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.59.10.224
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-28.31.59.10.224||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.154.67
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/Frymaster.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 11:30:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:58234: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.249.149
country_id: 3865483
description:
Jan 15 11:29:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.249.149 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 161.22.56.151
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/farm/671/290585 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 11:30:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:58236: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.35.230
country_id: 953987
description:
Jan 15 11:30:47 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.35.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.248.165.82
country_id: 2017370
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/pick/635/400635 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.240.229
country_id: 2510769
description:
Jan 15 11:31:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.240.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.240.229
country_id: 2510769
description:
Jan 15 11:31:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.240.229 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.24.17.118
country_id: 1210997
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-74.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 11:32:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60081: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.36.250
country_id: 6290252
description:
Jan 15 11:32:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.36.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.209.220.126
country_id: 2287781
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Others/Plain RSC LxWxH-2-250x250.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.250.185.253
country_id: 2542007
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/markbaker/complex/classes/Autoloader.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 11:32:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60083: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.165.214.25
country_id: 192950
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/supermarket/14/174/1463556 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.253
country_id: 3469034
description:
Jan 15 11:38:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.205
country_id: 298795
description:
Jan 15 11:37:46 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.33.165
country_id: 3865483
description:
Jan 15 11:37:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.33.165 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/sliders/company.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.179.26
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/fastfood.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.253
country_id: 3469034
description:
Jan 15 11:38:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.180.26
country_id: 1814991
description:
2026-01-15 11:40:51 dovecot_login authenticator failed for H=(dxekb) [111.179.180.26]:52992: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/monthly-report.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.180.26
country_id: 1814991
description:
2026-01-15 11:41:10 dovecot_login authenticator failed for H=(yrftq) [111.179.180.26]:52992: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.247
country_id: 3469034
description:
Jan 15 11:43:45 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 11:48:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:64948: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.66.142.184
country_id: 1694008
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/understand/13/1342013 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 11:48:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:64950: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.162
country_id: 1269750
description:
Jan 15 11:49:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.107.155.209
country_id: 798544
description:
Jan 15 11:49:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.107.155.209 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 24.146.235.239
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-50.24.146.235.239||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.137
country_id: 2510769
description:
Jan 15 11:51:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 11:52:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56548: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 11:52:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56549: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.136
country_id: 1269750
description:
Jan 15 11:53:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.47
country_id: 3175395
description:
Jan 15 11:53:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.47 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.81.53.171
country_id: 3469034
domain: webhosting2u.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/webhosting2u.com/masaaki/testimonials/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.58.235.169
country_id: 2963597
description:
Jan 15 11:53:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.58.235.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.72.174
country_id: 798544
description:
Jan 15 11:53:49 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.72.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.87.194.80
country_id: 1168579
description:
2026-01-15 11:54:12 dovecot_login authenticator failed for H=([127.0.0.1]) [103.87.194.80]:43237: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.15
country_id: 953987
description:
Jan 15 11:55:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.15
country_id: 953987
description:
Jan 15 11:55:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.182.73.131
country_id: 1835841
description:
Jan 15 11:56:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.182.73.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.137.209.54
country_id: 3469034
description:
Jan 15 11:56:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.137.209.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.89.208.174
country_id: 1605651
description:
Jan 15 11:56:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.89.208.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.57.137
country_id: 3469034
description:
Jan 15 11:58:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.57.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.108.190
country_id: 798544
description:
Jan 15 11:58:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.108.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.204
country_id: 953987
description:
Jan 15 11:59:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 12:00:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60232: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.108.190
country_id: 798544
description:
Jan 15 11:59:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.108.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.0.83.168
country_id: 1562822
description:
Jan 15 12:00:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.0.83.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.0.83.168
country_id: 1562822
description:
2026-01-15 12:00:14 dovecot_login authenticator failed for H=([127.0.0.1]) [117.0.83.168]:37974: 535 Incorrect authentication data (set_id=wks70110@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 12:00:17 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60236: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.199.217
country_id: 3865483
description:
Jan 15 12:00:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.199.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.87.201.135
country_id: 3469034
description:
Jan 15 12:01:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.87.201.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.61.142.172
country_id: 2510769
description:
Jan 15 12:04:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.61.142.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.61.142.172
country_id: 2510769
description:
Jan 15 12:04:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.61.142.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.66
country_id: 3996063
description:
Jan 15 12:04:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.232
country_id: 690791
description:
Jan 15 12:05:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 81.21.233.94
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-05.81.21.233.94||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.40.151
country_id: 6251999
description:
Jan 15 12:07:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.40.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2026-01-15 12:07:09 dovecot_login authenticator failed for H=96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:60956: 535 Incorrect authentication data (set_id=nicholas@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2026-01-15 12:08:14 dovecot_login authenticator failed for H=([182.79.95.139]) [152.52.246.178]:52538: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 207.182.29.186
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-09.207.182.29.186||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.246.178
country_id: 1269750
description:
Jan 15 12:08:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.246.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.213
country_id: 1269750
description:
Jan 15 12:10:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.213 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.80.145.28
country_id: 3469034
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?product_id=318&route=product/product&tag=general HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.127
country_id: 3175395
description:
Jan 15 12:11:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.227.166
country_id: 1269750
description:
Jan 15 12:12:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.227.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.95
country_id: 3175395
description:
Jan 15 12:11:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2026-01-15 12:12:10 dovecot_login authenticator failed for H=([103.56.85.65]) [128.185.227.166]:40396: 535 Incorrect authentication data (set_id=lkwong.isc@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.68.37.25
country_id: 2661886
description:
Jan 15 12:15:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.68.37.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 12:15:49 H=([45.144.212.242]) [45.144.212.242]:49336 F=<lynnied@mhtc.net> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2026-01-15 12:15:43 dovecot_plain authenticator failed for H=78-68-37-25-no2560.tbcn.telia.com (oisatity) [78.68.37.25]:48706: 535 Incorrect authentication data (set_id=sheila@dps-comsec.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.244
country_id: 1814991
description:
Jan 15 12:16:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 12:18:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:54618: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.22.140
country_id: 1269750
description:
Jan 15 12:18:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.22.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.244
country_id: 1814991
description:
Jan 15 12:18:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 12:18:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:54621: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-01-15 12:18:14 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:65054: 535 Incorrect authentication data (set_id=admin@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 12:20:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56569: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.13.220.220
country_id: 6252001
description:
Jan 15 12:19:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.13.220.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-15 12:19:39 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (barslings) [73.13.220.220]:48246: 535 Incorrect authentication data (set_id=fitriyah@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
country_id: 1814991
description:
Jan 15 12:20:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 12:20:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56570: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.118.39.30
country_id: 3573591
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/inkinterest/271/330488 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.0.83.168
country_id: 1562822
description:
2026-01-15 12:20:36 dovecot_login authenticator failed for H=([127.0.0.1]) [117.0.83.168]:45786: 535 Incorrect authentication data (set_id=54786059@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
country_id: 1814991
description:
2026-01-15 12:20:14 dovecot_login authenticator failed for H=([61.143.241.150]) [61.143.241.150]:51973: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.0.83.168
country_id: 1562822
description:
Jan 15 12:20:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.0.83.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.217.120.52
country_id: 1269750
description:
Jan 15 12:20:49 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.217.120.52 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.241.194
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-23.166.0.241.194||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.15.74.155
country_id: 2464461
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/cry/144/39942 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.54
country_id: 3175395
description:
Jan 15 12:25:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.222.203.89
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/sebastian/comparator/src/TypeComparator.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.54
country_id: 3175395
description:
Jan 15 12:26:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.105.141.237
country_id: 798544
description:
Jan 15 12:26:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.105.141.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 12:28:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60400: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 12:28:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60402: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.179.182.59
country_id: 1814991
description:
Jan 15 12:28:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.179.182.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.182.59
country_id: 1814991
description:
2026-01-15 12:28:29 dovecot_login authenticator failed for H=(hqdcg) [111.179.182.59]:51909: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.182.59
country_id: 1814991
description:
2026-01-15 12:29:11 dovecot_login authenticator failed for H=(bdqwz) [111.179.182.59]:51909: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.72.34.64
country_id: 1668284
description:
Jan 15 12:31:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.72.34.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.72.34.64
country_id: 1668284
description:
2026-01-15 12:31:18 dovecot_login authenticator failed for H=211-72-34-64.hinet-ip.hinet.net [211.72.34.64]:35788: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.32
country_id: 6252001
description:
Jan 15 12:31:25 sv3 pure-ftpd[3291566]: (?@162.142.125.32) [INFO] New connection from 162.142.125.32


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.151
country_id: 2017370
description:
Jan 15 12:31:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.151
country_id: 2017370
description:
2026-01-15 12:31:29 dovecot_login authenticator failed for H=([178.178.194.151]) [178.178.194.151]:50002: 535 Incorrect authentication data (set_id=bizdevelopment)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.61
country_id: 690791
description:
Jan 15 12:32:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.175.135.180
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-33.107.175.135.180||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.46.68
country_id: 2395170
description:
Jan 15 12:35:49 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.46.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.19.219.151
country_id: 6252001
description:
2026-01-15 12:36:06 dovecot_login authenticator failed for H=([127.0.0.1]) [71.19.219.151]:48260: 535 Incorrect authentication data (set_id=info@vmsmotorsports.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 12:39:58 H=([45.144.212.242]) [45.144.212.242]:51999 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.131.240.7
country_id: 798544
description:
Jan 15 12:41:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.131.240.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.116
country_id: 3175395
description:
Jan 15 12:41:45 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.173.18.83
country_id: 3865483
description:
Jan 15 12:42:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.173.18.83 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.245.173.168
country_id: 3469034
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-42.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.173.18.83
country_id: 3865483
description:
Jan 15 12:42:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.173.18.83 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.161.48
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/Scotsman.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.192.240.47
country_id: 3996063
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Flute/BA-Flute-2-150x150.JPG HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/images/sliders/sitemap.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 12:46:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:65346: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.43.126.228
country_id: 3895114
domain: webhosting2u.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/webhosting2u.com/masaaki/about/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 12:46:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:65349: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.240.225
country_id: 2510769
description:
Jan 15 12:46:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.240.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.16.88.136
country_id: 1269750
description:
Jan 15 12:46:52 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.16.88.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 12:48:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56609: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 12:48:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56610: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/fphortier/images/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.138.245.58
country_id: 1733045
description:
[2026-01-15 12:48:57 +0800] info [webmaild] 175.138.245.58 - mag@symphony-led.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 12:51:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:38575: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.180.169
country_id: 1814991
description:
2026-01-15 12:51:18 dovecot_login authenticator failed for H=(ocdgz) [111.179.180.169]:59198: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 12:51:17 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:38576: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cert.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.19
country_id: 1269750
description:
Jan 15 12:51:36 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 12:53:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:27437: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 12:53:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:27437: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 12:54:17 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:38579: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 57.155.170.164
country_id: 1880251
domain: myfurnitureshop.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.furniturerun.com||User:myfurnit||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 12:56:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60667: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 12:56:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:27451: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-15 12:56:56 H=([45.144.212.242]) [45.144.212.242]:62204 F=<no_reply@admin.com> rejected RCPT <bengkok.lim@acburn.com.my>: Sender verify failed


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 12:57:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:38580: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 12:56:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60668: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 12:56:17 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:27452: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 12:57:25 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:38581: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.73.11
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-59.92.71.73.11||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 12:59:09 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:27464: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 13:00:16 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:38583: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.212.243
country_id: 1733045
description:
[2026-01-15 13:00:31 +0800] info [webmaild] 113.211.212.243 - lowts@lvconsult.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.5.147
country_id: 798544
description:
Jan 15 13:02:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.5.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 13:02:17 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:28030: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.70.162
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-02.142.111.70.162||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 124.82.105.167
country_id: 1733045
description:
[2026-01-15 13:02:53 +0800] info [cpaneld] 124.82.105.167 - pftfood "GET /cpsess1791985587/frontend/jupiter/index.html?login=1&post_login=967094883296 HTTP/1.1" DEFERRED LOGIN cpaneld: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.154.254
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-27.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.5.147
country_id: 798544
description:
Jan 15 13:02:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.5.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.248.166.231
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-03.109.248.166.231||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.102.16
country_id: 798544
description:
Jan 15 13:03:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.102.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.49
country_id: 3469034
description:
Jan 15 13:05:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.41.98
country_id: 953987
description:
Jan 15 13:04:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.41.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.131.20
country_id: 99237
description:
Jan 15 13:05:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.131.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.194.230
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/ramsey/uuid/src/functions.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.155.55
country_id: 1880251
domain: appointment.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Loader/schema/dic/xliff-core/xml.xsd||User:visoftcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.49
country_id: 3469034
description:
Jan 15 13:05:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.237.38
country_id: 6252001
description:
[2026-01-15 13:06:22 +0800] info [webmaild] 216.26.237.38 - kitty.yap@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.16.80
country_id: 2300660
description:
Jan 15 13:07:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.16.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.181.96
country_id: 1814991
description:
2026-01-15 13:08:22 dovecot_login authenticator failed for H=(xxfhc) [111.179.181.96]:54034: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/career.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 13:10:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:38588: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.100
country_id: 798544
description:
Jan 15 13:10:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.222.237
country_id: 798544
description:
Jan 15 13:10:42 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.222.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.198
country_id: 1269750
description:
Jan 15 13:10:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.248.223
country_id: 732800
description:
Jan 15 13:11:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.248.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.242.40
country_id: 1269750
description:
Jan 15 13:11:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.242.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 13:10:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:38589: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.1.109.51
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/services.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 13:12:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:28040: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.198
country_id: 1269750
description:
Jan 15 13:11:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.242.40
country_id: 1269750
description:
Jan 15 13:11:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.242.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 13:12:20 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:28042: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.239.36
country_id: 1269750
description:
Jan 15 13:12:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.239.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.181.96
country_id: 1814991
description:
2026-01-15 13:12:56 dovecot_login authenticator failed for H=(qmasr) [111.179.181.96]:58710: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.85.167
country_id: 3469034
description:
Jan 15 13:13:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.85.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 13:14:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:56380: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.248.223
country_id: 732800
description:
Jan 15 13:14:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.248.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jan 15 13:13:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.181.96
country_id: 1814991
description:
2026-01-15 13:13:18 dovecot_login authenticator failed for H=(wnpqv) [111.179.181.96]:58710: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.248.223
country_id: 732800
description:
Jan 15 13:14:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.248.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 13:14:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:56382: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 13:15:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 13:16:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56640: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 13:16:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56641: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.50.159.59
country_id: 3865483
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-73.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-01-15 13:18:41 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:60866: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.196.48
country_id: 3469034
description:
Jan 15 13:18:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.196.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
country_id: 1835841
description:
Jan 15 13:18:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.27.215.5
country_id: 1168579
domain: kainanholding.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:43579.kainanholding.com||ServerName:kainanholding.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6e5f4ebc11f4dcb63270b761d7a206d6679e1e6c||Title:0x00e425e4||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.0.83.168
country_id: 1562822
description:
Jan 15 13:19:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.0.83.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.0.83.168
country_id: 1562822
description:
2026-01-15 13:19:43 dovecot_login authenticator failed for H=([127.0.0.1]) [117.0.83.168]:44091: 535 Incorrect authentication data (set_id=jyteh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 13:19:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.57.186
country_id: 953987
description:
Jan 15 13:20:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.57.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.226.27.227
country_id: 294640
description:
Jan 15 13:20:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.226.27.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2026-01-15 13:20:30 dovecot_plain authenticator failed for H=(liteoper) [109.226.27.227]:42356: 535 Incorrect authentication data (set_id=admin@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 101.47.139.195
country_id: 1880251
domain: geminiflourmill.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/webdesign.monkeymedia2u.com||User:cabecom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.42
country_id: 3865483
description:
Jan 15 13:23:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 13:24:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60824: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.230.11.165
country_id: 2661886
description:
Jan 15 13:23:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.230.11.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 13:24:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60825: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 13:28:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:38591: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 13:28:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:38592: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.183.143
country_id: 1814991
description:
2026-01-15 13:28:22 dovecot_login authenticator failed for H=(yggbw) [111.179.183.143]:50974: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 173.254.193.7
country_id: 2077456
domain: www.oxbold.com
description:
IM360 WAF: Possible XSS in arguments||MV:https://www.oxbold.com/onedaypilot.htm?__im-wusrlvtt=13740164409707813691||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.183.143
country_id: 1814991
description:
2026-01-15 13:29:23 dovecot_login authenticator failed for H=(wmeav) [111.179.183.143]:50974: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 13:30:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:28085: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.159.85.208
country_id: 3469034
description:
Jan 15 13:31:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.159.85.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 13:30:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:28086: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.159.85.208
country_id: 3469034
description:
Jan 15 13:31:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.159.85.208 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.175.93.110
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-32.107.175.93.110||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 136.113.250.83
country_id: 6252001
domain: www.geminiflourmill.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('pwd',{'timeout':5000}).toString('base64');throw Object.assign(new Error('NEXT_REDIRECT'), {digest:`NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.62.164.16
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/fzaninotto/faker/readme.md HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 155.138.193.167
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.63||T:APACHE||RA:155.138.193.167||TA:155.138.193.167||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 13:42:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:60864: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.0.7.220
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/paragonie/random_compat/dist/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 13:42:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:60866: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.245.134.215
country_id: 2017370
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/paragonie/random_compat/dist HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 13:44:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56674: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 13:44:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56675: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.76
country_id: 690791
description:
Jan 15 13:46:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.108.184
country_id: 798544
description:
Jan 15 13:46:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.108.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.49
country_id: 3469034
description:
Jan 15 13:46:52 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.82.58
country_id: 1269750
description:
Jan 15 13:47:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.82.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.82.58
country_id: 1269750
description:
Jan 15 13:47:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.82.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.170.102
country_id: 1269750
description:
Jan 15 13:47:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.170.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.196.87
country_id: 798544
description:
Jan 15 13:47:49 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.196.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.111
country_id: 3469034
description:
Jan 15 13:48:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.111 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.215.198.166
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/tall/12/459/1283003 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 13:52:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60966: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.3.234
country_id: 3077311
description:
Jan 15 13:52:46 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.3.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 13:52:16 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60969: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.117.252
country_id: 1733045
description:
[2026-01-15 13:53:48 +0800] info [webmaild] 113.211.117.252 - felicia@nexuscollection.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.161.16.177
country_id: 4566966
description:
Jan 15 13:55:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.161.16.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.111
country_id: 3175395
description:
Jan 15 13:56:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.111 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.161.16.177
country_id: 4566966
description:
Jan 15 13:55:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.161.16.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.248.40.27
country_id: 3057568
description:
Jan 15 13:55:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.248.40.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.61
country_id: 1269750
description:
Jan 15 13:55:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.111
country_id: 3175395
description:
Jan 15 13:56:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.111 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.162
country_id: 1880251
domain: aircarbonic.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/aircarbonic.my/css/owl.carousel.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.163
country_id: 1880251
domain: aircarbonic.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/aircarbonic.my/css/fonts/fontawesome-webfont3e6e.woff2?v=4.7.0 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.237
country_id: 1880251
domain: aircarbonic.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/aircarbonic.my/js/lightbox.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.173
country_id: 1880251
domain: aircarbonic.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/aircarbonic.my/js/script.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.234
country_id: 1880251
domain: aircarbonic.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/aircarbonic.my/css/style.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.186
country_id: 1880251
domain: aircarbonic.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/aircarbonic.my/js/jquery.validate.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.135
country_id: 1880251
domain: aircarbonic.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/aircarbonic.my/css/font-awesome.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.192
country_id: 1880251
domain: aircarbonic.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/aircarbonic.my/js/jquery.appear.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.168
country_id: 1880251
domain: aircarbonic.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/aircarbonic.my/css/animate.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.148
country_id: 1880251
domain: aircarbonic.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/aircarbonic.my/js/owl.carousel.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.233
country_id: 1880251
domain: aircarbonic.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/aircarbonic.my/js/jquery.countTo.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.228
country_id: 1880251
domain: aircarbonic.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/aircarbonic.my/js/jquery.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 13:58:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:38594: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.215
country_id: 1880251
domain: aircarbonic.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/aircarbonic.my/js/jquery.meanmenu.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.218
country_id: 1880251
domain: aircarbonic.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/aircarbonic.my/css/responsive.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.35.69.69
country_id: 2635167
domain: aircarbonic.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/aircarbonic.my/cryocall.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.197
country_id: 1880251
domain: aircarbonic.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/aircarbonic.my/css/meanmenu.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.204
country_id: 1880251
domain: aircarbonic.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/aircarbonic.my/js/isotope.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.132
country_id: 1880251
domain: aircarbonic.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/aircarbonic.my/js/imagesloaded.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 13:58:19 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:38595: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 14:00:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:28698: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 14:00:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:28698: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.104
country_id: 3469034
description:
Jan 15 14:04:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.173.177.133
country_id: 6252001
description:
Jan 15 14:05:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.173.177.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.173.177.133
country_id: 6252001
description:
2026-01-15 14:05:07 dovecot_login authenticator failed for H=(qmskn) [107.173.177.133]:58496: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.13
country_id: 690791
description:
Jan 15 14:05:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.108
country_id: 3865483
description:
Jan 15 14:05:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.186
country_id: 690791
description:
Jan 15 14:05:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.186 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.186
country_id: 1269750
description:
Jan 15 14:06:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.186 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-15 14:07:29 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.78.137.185
country_id: 3077311
description:
Jan 15 14:07:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.78.137.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.186
country_id: 1269750
description:
Jan 15 14:07:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.249.136
country_id: 3865483
description:
Jan 15 14:07:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.249.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.179.183.166
country_id: 1814991
description:
Jan 15 14:08:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.179.183.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.183.166
country_id: 1814991
description:
2026-01-15 14:08:16 dovecot_login authenticator failed for H=(ddguq) [111.179.183.166]:61354: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 14:10:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:53957: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.233.243
country_id: 1835841
description:
2026-01-15 14:10:05 dovecot_login authenticator failed for H=([221.149.233.243]) [221.149.233.243]:49509: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 85.121.5.30
country_id: 798549
domain: cordage.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_65) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/81.5.4044.62 Safari/537.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.233.243
country_id: 1835841
description:
Jan 15 14:10:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.233.243 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.199.12.56
country_id: 6252001
domain: plomalite.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:14-10.138.199.12.56||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.51.232.108
country_id: 6252001
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cabe.com.my/food.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.135
country_id: 1880251
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cabe.com.my/application/themes/bishop/fonts/fontawesome/fontawesome-webfont5b62.woff2?v=4.6.3 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.155
country_id: 1880251
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cabe.com.my/application/themes/bishop/css/style.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 14:10:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:53960: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.142
country_id: 1880251
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cabe.com.my/application/themes/bishop/css/all.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.144
country_id: 1880251
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cabe.com.my/application/themes/bishop/fonts/biotif-regular-webfont.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.145
country_id: 1880251
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cabe.com.my/application/themes/bishop/fonts/biotif-bold-webfont.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 14:12:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56698: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 14:12:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56698: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.168.138.138
country_id: 3996063
description:
Jan 15 14:12:52 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.168.138.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-15 14:13:58 +0800] info [webmaild] 203.106.96.63 - ehsan@sutsb.com.my "GET /cpsess9444074503/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.28.177.141
country_id: 2017370
description:
2026-01-15 14:14:42 dovecot_plain authenticator failed for H=(cartheled) [37.28.177.141]:24368: 535 Incorrect authentication data (set_id=info@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.28.177.141
country_id: 2017370
description:
Jan 15 14:14:40 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.28.177.141 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 71.172.239.34
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/wrong/9/601/980197 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.97.74
country_id: 1269750
description:
Jan 15 14:17:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.97.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2026-01-15 14:17:11 dovecot_login authenticator failed for H=([128.185.224.142]) [27.123.97.74]:38720: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 14:20:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61137: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.183.120
country_id: 1814991
description:
2026-01-15 14:20:08 dovecot_login authenticator failed for H=(cmnkm) [111.179.183.120]:65475: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-01-15 14:20:57 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (ching) [73.145.107.251]:51518: 535 Incorrect authentication data (set_id=info@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 14:20:11 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61137: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.183.120
country_id: 1814991
description:
2026-01-15 14:20:16 dovecot_login authenticator failed for H=(olkma) [111.179.183.120]:65475: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.117.252
country_id: 1733045
description:
[2026-01-15 14:20:31 +0800] info [webmaild] 113.211.117.252 - felicia@nexuscollection.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.145.107.251
country_id: 6252001
description:
Jan 15 14:20:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.145.107.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.114.243.81
country_id: 3625428
description:
Jan 15 14:22:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.114.243.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.243.81
country_id: 3625428
description:
2026-01-15 14:22:03 dovecot_login authenticator failed for H=([190.114.243.80]) [190.114.243.81]:46524: 535 Incorrect authentication data (set_id=slgoh@kendek.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.44.54
country_id: 1269750
description:
Jan 15 14:21:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.44.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2026-01-15 14:22:00 dovecot_login authenticator failed for H=(static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:60510: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.213.229.128
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-24.89.213.229.128||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-15 14:25:08 +0800] info [webmaild] 113.211.37.45 - chuan@tschuan.com "GET /cpsess1903874427/3rdparty/roundcube/?_task=mail&_mbox=INBOX.spam HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.223.127.143
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/ice/12/146/1256895 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 14:26:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:38597: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 14:26:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:38598: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.3.187
country_id: 953987
description:
Jan 15 14:27:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.3.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 14:28:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:29302: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/images/home/team.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.66.237.221
country_id: 2017370
description:
Jan 15 14:27:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.66.237.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.66.237.221
country_id: 2017370
description:
2026-01-15 14:27:29 dovecot_login authenticator failed for H=([178.66.237.221]) [178.66.237.221]:56734: 535 Incorrect authentication data (set_id=support@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 14:28:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:29303: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/video.php||SC:/home/indfinitydesign/public_html/images/video.php||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.183
country_id: 6252001
description:
Jan 15 14:30:48 sv3 pure-ftpd[3450943]: (?@167.94.138.183) [INFO] New connection from 167.94.138.183


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.125.55
country_id: 1733045
description:
Jan 15 14:31:35 sv3 pure-ftpd[3452256]: (?@113.211.125.55) [INFO] New connection from 113.211.125.55


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.179.183.120
country_id: 1814991
description:
Jan 15 14:31:40 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.179.183.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.183.120
country_id: 1814991
description:
2026-01-15 14:31:42 dovecot_login authenticator failed for H=(trkkv) [111.179.183.120]:58360: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.183.120
country_id: 1814991
description:
2026-01-15 14:32:19 dovecot_login authenticator failed for H=(eskeh) [111.179.183.120]:58360: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.212.90
country_id: 933860
description:
Jan 15 14:32:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.212.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.108.109
country_id: 1733045
description:
[2026-01-15 14:33:45 +0800] info [webmaild] 113.211.108.109 - bentey@mckd.com.my "GET /apple-touch-icon-precomposed.png HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.42.1.124
country_id: 798544
description:
Jan 15 14:34:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.42.1.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.42.1.124
country_id: 798544
description:
2026-01-15 14:34:53 dovecot_login authenticator failed for H=(bMEyWl) [31.42.1.124]:50312: 535 Incorrect authentication data (set_id=yoke-tin.loh@cofreth.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.104.220
country_id: 3469034
description:
Jan 15 14:34:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.104.220 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-15 14:35:49 +0800] info [webmaild] 113.211.37.45 - chuan@tschuan.com "GET /cpsess1903874427/3rdparty/roundcube/?_task=mail&_mbox=INBOX.spam HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.79.247
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-35.92.71.79.247||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.137.70.177
country_id: 1168579
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-39.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-15 14:35:31 H=([45.144.212.50]) [45.144.212.50]:65481 F=<arm@da-desk.com> rejected RCPT <celine@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 14:38:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:61144: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 14:38:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:61146: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.60.116
country_id: 798544
description:
Jan 15 14:38:31 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.60.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.170.102
country_id: 1269750
description:
Jan 15 14:38:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.170.102 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 14:40:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56725: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 14:40:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56725: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 43.225.161.213
country_id: 1269750
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-79.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.239.40.78
country_id: 6251999
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-46.104.239.40.78||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 14:48:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61278: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.226.176.195
country_id: 3996063
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/press-details.php?id=107240 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 14:48:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61279: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-15 14:50:37 H=([45.144.212.50]) [45.144.212.50]:63628 F=<opskhulna@atlas-bd.com> rejected RCPT <celine@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from atlas-bd.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.203
country_id: 1269750
description:
Jan 15 14:51:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 14:54:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:38616: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 14:54:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:38618: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.21.36
country_id: 2300660
description:
Jan 15 14:54:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.21.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 14:56:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:29907: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.123.13
country_id: 798544
description:
Jan 15 14:56:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.123.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-15 14:56:29 H=([45.144.212.54]) [45.144.212.54]:54358 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <azman@ajplantations.com.my>: No Such User Here"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 14:56:21 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:29908: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.27
country_id: 798544
description:
Jan 15 15:00:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.127
country_id: 3175395
description:
Jan 15 14:59:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.60
country_id: 3469034
description:
Jan 15 14:59:40 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.27
country_id: 798544
description:
Jan 15 15:00:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.52
country_id: 2395170
description:
Jan 15 15:00:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.52
country_id: 2395170
description:
Jan 15 15:01:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.217
country_id: 3175395
description:
Jan 15 15:01:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.217 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 23.239.28.113
country_id: 6252001
domain: 34.217.47.154
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.217.47.154/azenv3.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.183.188
country_id: 1814991
description:
2026-01-15 15:03:30 dovecot_login authenticator failed for H=(khday) [111.179.183.188]:60232: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.183.188
country_id: 1814991
description:
2026-01-15 15:04:09 dovecot_login authenticator failed for H=(oixvk) [111.179.183.188]:60232: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 15:06:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:58650: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-15 15:06:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:58650: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 15:07:46 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 15:08:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56761: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 15:08:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56761: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.72.92.174
country_id: 1814991
description:
Jan 15 15:08:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.72.92.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
country_id: 1814991
description:
2026-01-15 15:08:34 dovecot_login authenticator failed for H=([125.72.92.174]) [125.72.92.174]:54850: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-15 15:10:23 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (cosple) [73.213.237.28]:42114: 535 Incorrect authentication data (set_id=admin@dps-comsec.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.213.237.28
country_id: 6252001
description:
Jan 15 15:10:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.213.237.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.247.59.158
country_id: 2017370
description:
Jan 15 15:12:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.247.59.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.247.59.158
country_id: 2017370
description:
2026-01-15 15:12:31 dovecot_login authenticator failed for H=([188.247.59.158]) [188.247.59.158]:36796: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.159.87.46
country_id: 3469034
description:
Jan 15 15:13:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.159.87.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 15:12:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.159.87.46
country_id: 3469034
description:
Jan 15 15:13:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.159.87.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.205.212.181
country_id: 290557
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/36chartreadwriteHTML.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.185.159
country_id: 3469034
description:
Jan 15 15:15:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.185.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 15:16:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61438: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.185.159
country_id: 3469034
description:
Jan 15 15:16:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.185.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 15:16:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61439: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/img/photos/about.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.87.104.128
country_id: 1269750
description:
Jan 15 15:18:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.87.104.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.148
country_id: 1269750
description:
Jan 15 15:19:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.133.116.71
country_id: 798544
description:
Jan 15 15:20:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.133.116.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.209
country_id: 953987
description:
Jan 15 15:19:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.148
country_id: 1269750
description:
Jan 15 15:19:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.148 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/img/photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.131
country_id: 3175395
description:
Jan 15 15:20:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.131 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.192.160.197
country_id: 1168579
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/egulias/email-validator/EmailValidator/Exception/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.51.118.10
country_id: 3469034
description:
Jan 15 15:20:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.51.118.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.133.116.71
country_id: 798544
description:
Jan 15 15:20:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.133.116.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.139
country_id: 3175395
description:
Jan 15 15:20:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.129.104
country_id: 3469034
description:
Jan 15 15:20:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.129.104 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.244.108.190
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/egulias/email-validator/EmailValidator/Exception HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.149.187
country_id: 587116
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-7.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 15:22:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:39187: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.125.55
country_id: 1733045
description:
Jan 15 15:22:30 sv3 pure-ftpd[3534680]: (?@113.211.125.55) [INFO] New connection from 113.211.125.55


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.125.55
country_id: 1733045
description:
Jan 15 15:22:47 sv3 pure-ftpd[3534883]: (myfurnit@113.211.125.55) [NOTICE] /home/myfurnit//public_html/sofa37.html uploaded  (10671 bytes, 1225.53KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 15:22:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:39188: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 113.211.214.183
country_id: 1733045
domain: pftfood.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/454/feedback||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 113.211.214.183
country_id: 1733045
domain: pftfood.com
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.63||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/454/feedback||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.119
country_id: 798544
description:
Jan 15 15:23:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.217
country_id: 3469034
description:
Jan 15 15:23:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 15:24:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:29929: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 15:24:11 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:29929: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 182.11.152.65
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home/pftfood/tmp/awstats/awstats.pftfood.com.conf||User:pftfood||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.213.237.28
country_id: 6252001
description:
Jan 15 15:27:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.213.237.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-15 15:27:39 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (chrotin) [73.213.237.28]:37764: 535 Incorrect authentication data (set_id=jeffrey.hong@tujusetia.my)


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 10.1.14.100
description:
Jan 15 15:27:47 sv3 sshd[3543022]: Accepted publickey for root from 10.1.14.100 port 55849 ssh2: RSA SHA256:WdDh84n9i7OwfL83TC4Q9y94bNOmxYGU2yeZfrTsxL0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.213.237.28
country_id: 6252001
description:
Jan 15 15:30:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.213.237.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-15 15:30:34 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (unted) [73.213.237.28]:53388: 535 Incorrect authentication data (set_id=kokfoh.liau@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.165.114.7
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/sebastian/global-state/LICENSE HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.8
country_id: 3175395
description:
Jan 15 15:32:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.8 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.68.127
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/ramsey/uuid/src/Uuid.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 15:36:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56789: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.129
country_id: 3469034
description:
Jan 15 15:36:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.129
country_id: 3469034
description:
Jan 15 15:36:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 15:36:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56790: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.142.125.123
country_id: 6252001
description:
2026-01-15 15:36:32 110059 [Warning] Aborted connection 110059 to db: 'unconnected' user: 'unauthenticated' host: '162.142.125.123' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/img/photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/interior.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.179.181.79
country_id: 1814991
description:
Jan 15 15:41:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.179.181.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.181.79
country_id: 1814991
description:
2026-01-15 15:41:41 dovecot_login authenticator failed for H=(uhjye) [111.179.181.79]:50335: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.179.181.79
country_id: 1814991
description:
Jan 15 15:42:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.179.181.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.181.79
country_id: 1814991
description:
2026-01-15 15:42:27 dovecot_login authenticator failed for H=(poxzl) [111.179.181.79]:50335: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.235.122
country_id: 3865483
description:
Jan 15 15:42:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.235.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.192.67.43
country_id: 3077311
description:
Jan 15 15:42:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.192.67.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/images/index.php||SC:/home/indfinitydesign/public_html/img/photos/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 15:44:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63789: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 15:44:10 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63791: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/druma/druma.php||SC:/home/indfinitydesign/public_html/images/druma||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.173
country_id: 3865483
description:
Jan 15 15:48:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.36.139
country_id: 953987
description:
Jan 15 15:49:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.36.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.36.139
country_id: 953987
description:
Jan 15 15:49:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.36.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 15:50:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:39195: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 15:50:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:39196: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 15:52:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:30523: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 15:52:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:30525: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.205
country_id: 2300660
description:
Jan 15 15:55:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.192.205.23
country_id: 798544
description:
Jan 15 15:56:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.192.205.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.205
country_id: 2300660
description:
Jan 15 15:56:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.192.205.23
country_id: 798544
description:
Jan 15 15:56:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.192.205.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.247.48
country_id: 798544
description:
Jan 15 15:56:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.247.48 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-15 15:58:55 +0800] info [webmaild] 113.211.37.45 - chuan@tschuan.com "GET /cpsess1903874427/3rdparty/roundcube/?_task=mail&_mbox=INBOX.spam HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.57.165
country_id: 953987
description:
Jan 15 15:59:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.57.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.14
country_id: 2395170
description:
Jan 15 16:01:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.53
country_id: 719819
description:
Jan 15 16:01:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.135.190
country_id: 1269750
description:
Jan 15 16:01:40 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.135.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.179.183.144
country_id: 1814991
description:
Jan 15 16:02:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.179.183.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.183.144
country_id: 1814991
description:
2026-01-15 16:02:05 dovecot_login authenticator failed for H=(xvobe) [111.179.183.144]:63773: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.179.183.144
country_id: 1814991
description:
Jan 15 16:02:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.179.183.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.183.144
country_id: 1814991
description:
2026-01-15 16:02:14 dovecot_login authenticator failed for H=(kymxq) [111.179.183.144]:63773: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 16:04:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56820: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 16:04:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56821: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.183.221
country_id: 1814991
description:
2026-01-15 16:07:27 dovecot_login authenticator failed for H=(hgdqo) [111.179.183.221]:51444: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-15 16:08:07 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.110.212.48
country_id: 3077311
description:
Jan 15 16:09:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.110.212.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.117
country_id: 3469034
description:
Jan 15 16:09:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.51.42
country_id: 1149361
description:
Jan 15 16:09:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.51.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.42
country_id: 1149361
description:
2026-01-15 16:09:50 dovecot_login authenticator failed for H=([149.54.51.42]) [149.54.51.42]:57656: 535 Incorrect authentication data (set_id=nicholas@eminent.st)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-15 16:12:01 +0800] info [webmaild] 175.144.229.115 - admin@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 16:12:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63932: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 16:12:12 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63932: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.50.35.84
country_id: 1733045
description:
[2026-01-15 16:12:28 +0800] info [webmaild] 60.50.35.84 - pylim@af-sb.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 proxy - [01/15/2026:08:12:29 -0000] "GET /cPanel_magic_revision_1748878853/unprotected/cpanel/style_v2_optimized.css HTTP/1.1" 200 0 "https://webmail.ds-staffing.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13079956&pdata=https%253A%252F%252Fwebmail.ds-staffing.com%252F404.shtml&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768464741" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "-" "X-Forwarded-For: 34.123.170.104" 443


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-15 16:13:20 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (horang) [68.40.189.43]:39326: 535 Incorrect authentication data (set_id=akmal@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.247.32
country_id: 798544
description:
Jan 15 16:13:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.247.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.211.52.67
country_id: 2328926
description:
Jan 15 16:13:36 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.211.52.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.52.67
country_id: 2328926
description:
2026-01-15 16:13:38 dovecot_login authenticator failed for H=(l7WByKs) [197.211.52.67]:37729: 535 Incorrect authentication data (set_id=katsy@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.40.189.43
country_id: 6252001
description:
Jan 15 16:13:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.40.189.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.169.52.67
country_id: 2017370
description:
Jan 15 16:13:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.169.52.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.169.52.67
country_id: 2017370
description:
2026-01-15 16:13:36 dovecot_login authenticator failed for H=([193.169.52.67]) [193.169.52.67]:49572: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.211.52.67
country_id: 2328926
description:
Jan 15 16:14:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.211.52.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.52.67
country_id: 2328926
description:
2026-01-15 16:14:21 dovecot_login authenticator failed for H=(PnJTdXwbHB) [197.211.52.67]:37732: 535 Incorrect authentication data (set_id=katsy@urban.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.193
country_id: 6252001
description:
2026-01-15 16:17:45 111702 [Warning] Aborted connection 111702 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.193' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 16:18:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:39203: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-15 16:17:17 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 16:18:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:39204: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.80.185
country_id: 690791
description:
Jan 15 16:18:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.80.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.80.185
country_id: 690791
description:
2026-01-15 16:18:58 dovecot_plain authenticator failed for H=(poriosunic) [178.16.80.185]:48314: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-15 16:19:10 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess4351433493/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.58.198.205
country_id: 3573591
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/byecake/11/423/1137273 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.229.141
country_id: 1562822
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/p-2.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 16:20:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:30545: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 16:20:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:30546: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-15 16:20:29 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess4351433493/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-15 16:21:29 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess4351433493/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.204.14.121
country_id: 6252001
domain: ms-chemicals.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ms-chemicals.net/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-15 16:24:54 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess4441584544/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.99
country_id: 798544
description:
Jan 15 16:24:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.227.136.237
country_id: 6252001
description:
2026-01-15 16:24:47 dovecot_login authenticator failed for H=(syn-072-227-136-237.res.spectrum.com) [72.227.136.237]:35004: 535 Incorrect authentication data (set_id=salesmp@aoto.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.227.136.237
country_id: 6252001
description:
Jan 15 16:24:45 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.227.136.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.135.138
country_id: 1168579
description:
Jan 15 16:24:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.135.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.205.219
country_id: 3469034
description:
Jan 15 16:25:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.205.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.99
country_id: 798544
description:
Jan 15 16:25:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.135.138
country_id: 1168579
description:
Jan 15 16:25:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.135.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.234.113.143
country_id: 798544
description:
Jan 15 16:25:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.234.113.143 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-15 16:25:29 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess4351433493/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.40.189.43
country_id: 6252001
description:
Jan 15 16:28:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.40.189.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-15 16:28:59 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (quottion) [68.40.189.43]:59542: 535 Incorrect authentication data (set_id=no-replay@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.0.129.97
country_id: 3865483
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/1191009474.jpg&size=1000x1000 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.98.119.87
country_id: 798544
description:
Jan 15 16:31:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.98.119.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 16:32:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56841: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.78
country_id: 732800
description:
Jan 15 16:33:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 16:32:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56842: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.254
country_id: 3175395
description:
Jan 15 16:32:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.184.168
country_id: 1814991
description:
2026-01-15 16:33:50 dovecot_login authenticator failed for H=(avcym) [111.179.184.168]:52800: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.78
country_id: 732800
description:
Jan 15 16:33:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.78 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.48.71.209
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/3-Reasons-to-Maintain-Commercial-Kitchen-Appliances.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.221.252
country_id: 1210997
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/Sirman.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.184.168
country_id: 1814991
description:
2026-01-15 16:34:12 dovecot_login authenticator failed for H=(ejypz) [111.179.184.168]:52800: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.176.233.108
country_id: 3686110
description:
[2026-01-15 16:37:02 +0800] info [whostmgrd] 45.176.233.108 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.245.250.157
country_id: 3469034
description:
Jan 15 16:38:47 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.245.250.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.59.224.103
country_id: 798544
description:
Jan 15 16:39:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.59.224.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.59.224.103
country_id: 798544
description:
Jan 15 16:39:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.59.224.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 16:40:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64095: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 16:40:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64096: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.131.71.46
country_id: 1562822
domain: www.feliogroup.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/https:/www.the3rdeye.com.my/home/therdeye/public_html/www.feliogroup.com||User:feliogroupcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.64.122
country_id: 3469034
description:
Jan 15 16:45:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.64.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 16:46:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:39208: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.107.155.216
country_id: 798544
description:
Jan 15 16:46:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.107.155.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 16:46:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:39209: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.72.35.198
country_id: 290557
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/ceiling/17/360/1756372 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 16:48:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:31139: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.248
country_id: 2510769
description:
Jan 15 16:48:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.23.247.168
country_id: 953987
description:
Jan 15 16:48:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.23.247.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.87.116.230
country_id: 3469034
description:
Jan 15 16:48:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.87.116.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.248
country_id: 2510769
description:
Jan 15 16:48:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.23.247.168
country_id: 953987
description:
Jan 15 16:48:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.23.247.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 16:48:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:31140: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.184.145
country_id: 1814991
description:
2026-01-15 16:50:05 dovecot_login authenticator failed for H=(qmxua) [111.179.184.145]:61643: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.184.145
country_id: 1814991
description:
2026-01-15 16:50:13 dovecot_login authenticator failed for H=(jwkyn) [111.179.184.145]:61643: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.179.184.145
country_id: 1814991
description:
Jan 15 16:53:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.179.184.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.184.145
country_id: 1814991
description:
2026-01-15 16:53:22 dovecot_login authenticator failed for H=(ushyu) [111.179.184.145]:49672: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.24.182.58
country_id: 1269750
description:
Jan 15 16:53:44 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.24.182.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.99
country_id: 3469034
description:
Jan 15 16:59:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.11.83
country_id: 798544
description:
Jan 15 16:59:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.11.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 17:00:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56890: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 17:00:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.254.142.133
country_id: 458258
description:
Jan 15 17:00:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.254.142.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.2
country_id: 3175395
description:
Jan 15 17:00:49 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.163.245
description:
2026-01-15 17:00:59 H=([64.89.163.245]) [64.89.163.245]:53334 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<busan@ecck.or.kr> rejected RCPT <info@mkmetal.com.my>: SPF: 64.89.163.245 is not allowed to send mail from ecck.or.kr


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 17:00:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56890: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.160.67
country_id: 3865483
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/mgmtsolutionspage/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.103
country_id: 3469034
description:
Jan 15 17:01:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.242
country_id: 2300660
description:
Jan 15 17:01:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.103
country_id: 3469034
description:
Jan 15 17:02:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.241.185
country_id: 1733045
description:
[2026-01-15 17:02:27 +0800] info [webmaild] 27.125.241.185 - jlpom@ajplantations.com.my "GET /cpsess1728500788/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=1035&_mbox=INBOX.Sent&_framed=1&_action=preview HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.241.228] != Current IP Address [27.125.241.185]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-15 17:02:46 +0800] info [webmaild] 115.134.149.232 - general02@smartcable.com.my "GET /cpsess4228189374/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.125.241.185
country_id: 1733045
description:
27.125.241.185 - - [15/Jan/2026:17:02:27 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9532000&pdata=https%253A%252F%252Fmail.ajplantations.com.my%253A2096%252Fcpsess1728500788%252F3rdparty%252Froundcube%252F%253F_task%253Dmail%2526_caps%253Dpdf%25253D1%25252Cflash%25253D0%25252Ctiff%25253D0%25252Cwebp%25253D1%25252Cpgpmime%25253D0%2526_uid%253D1035%2526_mbox%253DINBOX.Sent%2526_framed%253D1%2526_action%253Dpreview&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768467746 HTTP/2.0" 302 0 mail.ajplantations.com.my "https://mail.ajplantations.com.my:2096/cpsess1728500788/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=1035&_mbox=INBOX.Sent&_framed=1&_action=preview" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.125.241.185


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.241.152
country_id: 1733045
description:
[2026-01-15 17:02:43 +0800] info [webmaild] 27.125.241.152 - jlpom@ajplantations.com.my "GET /cpsess7041220260/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=1057&_mbox=INBOX.Sent&_framed=1&_action=preview HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.241.185] != Current IP Address [27.125.241.152]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 17:04:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.8.49
country_id: 2300660
description:
Jan 15 17:05:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.8.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.67
country_id: 953987
description:
Jan 15 17:06:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.67 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.44.30.237
country_id: 3573591
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/windsurfingmalaysia-faq.htm HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 17:08:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64281: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.176
country_id: 3175395
description:
Jan 15 17:08:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.13.162.43
country_id: 1814991
description:
Jan 15 17:07:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.13.162.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.162.43
country_id: 1814991
description:
2026-01-15 17:07:35 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.162.43]:41972: 535 Incorrect authentication data (set_id=inf@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-01-15 17:08:37 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:34170: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.184.204
country_id: 1814991
description:
2026-01-15 17:09:07 dovecot_login authenticator failed for H=(wclzh) [111.179.184.204]:58228: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.224.56
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-08.166.0.224.56||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 17:08:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64283: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.176
country_id: 3175395
description:
Jan 15 17:08:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.184.204
country_id: 1814991
description:
2026-01-15 17:09:27 dovecot_login authenticator failed for H=(zsakv) [111.179.184.204]:58228: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.38.41.152
country_id: 690791
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/Sirman.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.140.233.37
country_id: 2017370
description:
Jan 15 17:11:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.140.233.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.140.233.37
country_id: 2017370
description:
2026-01-15 17:11:12 dovecot_login authenticator failed for H=([62.140.233.37]) [62.140.233.37]:57104: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/img/photos/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-15 17:14:23 H=([45.144.212.50]) [45.144.212.50]:49375 F=<arm@da-desk.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">check &amp; print supplier invoice</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">keyin supplies invoice - purchase invoices in software</li>\r\n<li>open new vendor in software</li>\r\n<li>update the ambank template library</li>\r\n<li>in ambank download pdf bankslip put in folder (bank payment)</li>\r\n<li>open sales invoice to pob: envitgro (maxis nov'25-jan'26)</li>\r\n<li>go to find the old document payment voucher the audit - get approve ms. kho</li>\r\n</ul>||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.124.53
country_id: 1733045
description:
[2026-01-15 17:15:34 +0800] info [webmaild] 113.211.124.53 - s-osada@mckd.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-15 17:15:37 H=([45.144.212.50]) [45.144.212.50]:55381 F=<arm@da-desk.com> rejected RCPT <info@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.65.93.111
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/fire/14/521/1469062 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.80
country_id: 1269750
description:
Jan 15 17:17:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.4.111.26
country_id: 3469034
description:
[2026-01-15 17:17:49 +0800] info [whostmgrd] 189.4.111.26 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 12.74.95.13
country_id: 6252001
description:
[2026-01-15 17:17:52 +0800] info [cpaneld] 12.74.95.13 - dscexpatcom "GET /login/?login_only=1&user=dscexpatcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dscexpatcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.185.249.28
country_id: 3469034
description:
[2026-01-15 17:17:58 +0800] info [cpaneld] 177.185.249.28 - dscex "GET /login/?login_only=1&user=dscex&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dscex (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.172.195.194
country_id: 690791
description:
[2026-01-15 17:18:03 +0800] info [cpaneld] 46.172.195.194 - dsc "GET /login/?login_only=1&user=dsc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dsc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.77
country_id: 3175395
description:
Jan 15 17:17:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.187.144.153
country_id: 6252001
description:
[2026-01-15 17:17:35 +0800] info [cpaneld] 71.187.144.153 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.121.253.34
country_id: 3469034
description:
[2026-01-15 17:17:54 +0800] info [cpaneld] 138.121.253.34 - dscexpa "GET /login/?login_only=1&user=dscexpa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dscexpa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.99.15.163
country_id: 3658394
description:
[2026-01-15 17:17:56 +0800] info [cpaneld] 191.99.15.163 - dscexp "GET /login/?login_only=1&user=dscexp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dscexp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.247.171
country_id: 1733045
description:
[2026-01-15 17:18:00 +0800] info [cpaneld] 180.75.247.171 - dsce "GET /login/?login_only=1&user=dsce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dsce (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.38.185.124
country_id: 3017382
description:
[2026-01-15 17:18:04 +0800] info [cpaneld] 90.38.185.124 - ds "GET /login/?login_only=1&user=ds&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ds (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.23.125.83
country_id: 6252001
description:
Jan 15 17:18:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.23.125.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2026-01-15 17:18:23 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (twarocyaph) [24.23.125.83]:32904: 535 Incorrect authentication data (set_id=support@dps-comsec.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 102.129.145.138
country_id: 6252001
domain: www.maalloys.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.63||T:APACHE||RA:102.129.145.138||TA:102.129.145.138||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.188.90.234
country_id: 2017370
description:
2026-01-15 17:19:52 H=([64.188.90.234]) [64.188.90.234]:51621 F=<bounce@perfectpallette.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.34.129.127
country_id: 1168579
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/till/16/674/1625732 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.241.84.86
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/psr/simple-cache/src HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.164.137
country_id: 248816
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/psr/simple-cache/src/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 34.235.146.217
country_id: 6252001
domain: www.kendek.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.63||T:APACHE||RA:34.235.146.217||TA:34.235.146.217||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><span style=\"text-decoration: underline;\"><strong>thursday 15-jan-26</strong></span></p>\r\n<ul>\r\n<li>update tsb container arrival worksheet</li>\r\n<li>follow up and chase agent for import container delivery arrangement. we have 6 container import pending to deliver to warehouse as space is limited. at the moment we have 3 export container to be arranged as well. discuss with mr. anuar to unload the import container immediately.</li>\r\n<li>checking with excel horse on the quanity loaded.</li>\r\n<li>preparing shipping document export to 18d - feb b'26. cut-off 20-jan-26 eta manila 28-jan-26.</li>\r\n<li>first container 18d feb a'26 delay as vessel omit and transit at kaohsiung. updated eta 30-jan-26.</li>\r\n<li>preparing shipping documents for 18d - shipment form kk(sha) &amp; kk(ngb) : separate shipment - follow up with kk and 18d agent on the booking - all draft shipping document sent to 18d agent for checking before proceed to final.</li>\r\n<li>re-arrange with british horse feed on next collection - check with future forwarding sailing schedule.</li>\r\n<li>update tpy import schedule.</li>\r\n<li>follow up freight right on received cargoes.</li>\r\n<li>follow up kk order.</li>\r\n</ul>||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 17:28:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56924: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.194.154.167
country_id: 3469034
description:
Jan 15 17:28:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.194.154.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 17:28:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56925: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.111.204
country_id: 798544
description:
Jan 15 17:28:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.111.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-01-15 17:28:45 dovecot_login authenticator failed for H=([91.73.195.150]) [91.73.195.150]:54027: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.43.123
country_id: 6252001
description:
Jan 15 17:29:31 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.43.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2026-01-15 17:29:33 dovecot_plain authenticator failed for H=c-71-229-43-123.hsd1.ga.comcast.net (dibisonle) [71.229.43.123]:36642: 535 Incorrect authentication data (set_id=shirley.wong@tujusetia.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.233.20.145
country_id: 6251999
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-30.104.233.20.145||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.115
country_id: 3175395
description:
Jan 15 17:30:44 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.137.127.123
country_id: 690791
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/p-5.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.248.146.156
country_id: 3175395
description:
Jan 15 17:32:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.248.146.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.191
country_id: 3469034
description:
Jan 15 17:32:47 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.191 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/component/tag/images/portfolio-detail.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.38.185
country_id: 953987
description:
Jan 15 17:32:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.38.185 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 118.101.40.157
country_id: 1733045
description:
[2026-01-15 17:34:02 +0800] info [webmaild] 118.101.40.157 - eejb@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.153.193.211
country_id: 3895114
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Formatter/IntlFormatterInterface.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 17:36:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64493: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 17:36:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64493: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.188.90.234
country_id: 2017370
description:
2026-01-15 17:38:45 H=([64.188.90.234]) [64.188.90.234]:62740 F=<bounce@perfectpallette.com> rejected RCPT <admin8@tst-ma.com>: No Such User Here


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.207.26
country_id: 192950
description:
2026-01-15 17:39:57 dovecot_login authenticator failed for H=(213.5.130.153) [41.72.207.26]:39686: 535 Incorrect authentication data (set_id=amira.zahari@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.183
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/css/common.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.136
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/js/common.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.163
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/css/main.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.169
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/js/jquery.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.165
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/js/header.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.63.66.52
country_id: 3469034
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/productinfo/taikei/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.193.127
country_id: 1814991
description:
Jan 15 17:43:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.193.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.181
country_id: 798544
description:
Jan 15 17:43:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.52
country_id: 3469034
description:
Jan 15 17:43:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.210
country_id: 2300660
description:
Jan 15 17:43:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.240.209
country_id: 1269750
description:
Jan 15 17:43:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.240.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.145
country_id: 3175395
description:
Jan 15 17:43:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.145 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 172.226.42.167
country_id: 1733045
description:
[2026-01-15 17:43:52 +0800] info [webmaild] 172.226.42.167 - payment@tujusetia.my "POST /cpsess7899608965/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [172.225.181.92] != Current IP Address [172.226.42.167]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.91.42
country_id: 3469034
description:
Jan 15 17:44:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.91.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.73.188
country_id: 6252001
description:
Jan 15 17:44:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.73.188 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 202.142.172.10
country_id: 1168579
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-45.202.142.172.10||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 116.0.51.251
country_id: 1168579
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-45.116.0.51.251||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 103.177.240.146
country_id: 1168579
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-45.103.177.240.146||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.243.178.112
country_id: 2017370
description:
[2026-01-15 17:46:33 +0800] info [whostmgrd] 46.243.178.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.51.61.202
country_id: 2464461
description:
[2026-01-15 17:47:00 +0800] info [whostmgrd] 165.51.61.202 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-sinaran-utama-teknologi/images/about.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.241.208.226
country_id: 798544
description:
Jan 15 17:50:40 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.241.208.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.241.208.226
country_id: 798544
description:
2026-01-15 17:50:42 dovecot_plain authenticator failed for H=([185.241.208.226]) [185.241.208.226]:63402: 535 Incorrect authentication data (set_id=rubinee.arulanantham@cofreth.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.88.39.148
country_id: 1835841
description:
Jan 15 17:51:46 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.88.39.148 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-15 17:51:46 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.88.39.148
country_id: 1835841
description:
2026-01-15 17:51:48 dovecot_login authenticator failed for H=([127.0.0.1]) [220.88.39.148]:59646: 535 Incorrect authentication data (set_id=postmaster@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.190.205.221
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=27 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.221.23
country_id: 1831722
description:
2026-01-15 17:54:53 dovecot_login authenticator failed for H=(213.5.130.160) [36.37.221.23]:34899: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.165.5
country_id: 1269750
description:
2026-01-15 17:54:58 dovecot_login authenticator failed for H=(213.5.130.107) [59.98.165.5]:59281: 535 Incorrect authentication data (set_id=mdnaser@grandteknik.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 17:56:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56964: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.179.184.213
country_id: 1814991
description:
Jan 15 17:56:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.179.184.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.184.213
country_id: 1814991
description:
2026-01-15 17:56:32 dovecot_login authenticator failed for H=(pzdcq) [111.179.184.213]:57173: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 17:56:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56965: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li class=\"msolistparagraphcxspfirst\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>updated daily collection report &amp; daily cash flow</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>posted assembly orders</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; </span></span></span>create new customer card &ldquo;brian dean horse racing sdn bhd&rdquo; &amp; update new latest the address &ldquo;jungle pets shop 2&rdquo; for albert</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; </span></span></span>do posting sales invoices &amp; filing sales invoice</li>\r\n<li class=\"msolistparagraphcxsplast\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>asisst ms.kho to find documents for auditor as requested</li>\r\n</ul>||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.134.8
country_id: 3469034
description:
Jan 15 18:01:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.134.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.250.201.45
country_id: 3469034
description:
Jan 15 18:02:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.250.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 18:04:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64650: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 18:04:10 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64651: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.62.177.90
country_id: 3469034
description:
Jan 15 18:05:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.62.177.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.50.147
country_id: 3175395
description:
Jan 15 18:06:52 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.50.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.188.244.213
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-06.91.188.244.213||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.99
country_id: 1269750
description:
Jan 15 18:06:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.97
country_id: 298795
description:
Jan 15 18:07:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.97 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.177.166.65
country_id: 6252001
description:
[2026-01-15 18:08:14 +0800] info [whostmgrd] 75.177.166.65 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.84.209.146
country_id: 2017370
description:
Jan 15 18:11:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.84.209.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.84.209.146
country_id: 2017370
description:
2026-01-15 18:11:35 dovecot_login authenticator failed for H=([88.84.209.146]) [88.84.209.146]:56080: 535 Incorrect authentication data (set_id=salesmp@aoto.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.235.154.114
country_id: 1814991
description:
Jan 15 18:11:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.235.154.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.235.154.114
country_id: 1814991
description:
2026-01-15 18:11:40 dovecot_login authenticator failed for H=([221.235.154.114]) [221.235.154.114]:39454: 535 Incorrect authentication data (set_id=slgoh@kendek.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.224.152.198
country_id: 3658394
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-48.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.172.221.171
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-13.107.172.221.171||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.61.6
country_id: 290557
description:
Jan 15 18:14:46 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.61.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-15 18:14:46 +0800] info [webmaild] 115.134.149.232 - ken@smartcable.com.my "POST /cpsess9685134176/3rdparty/roundcube/?_task=mail&_unlock=loading1768472086864&_framed=1 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2026-01-15 18:14:48 dovecot_plain authenticator failed for H=(unnes) [5.32.61.6]:43112: 535 Incorrect authentication data (set_id=webmaster@kimmark.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.52.167.210
country_id: 3508796
description:
[2026-01-15 18:15:19 +0800] info [whostmgrd] 179.52.167.210 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.149
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/revolution/css/layers.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.150
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/revolution/css/settings.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 84.115.226.151
country_id: 2782113
domain: ms-chemicals.net
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/6/feedback||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.191
country_id: 3469034
description:
Jan 15 18:17:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.191 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.142
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/themify-font/themify-icons.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.154
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/mdi-font/css/material-design-iconic-font.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.133
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/slick/slick.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.145
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/animate.css/animate.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 84.115.226.151
country_id: 2782113
domain: ms-chemicals.net
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.63||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/6/feedback||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.112.52.241
country_id: 1210997
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.137
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/css-hamburgers/hamburgers.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.134
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/css/poppins-font.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.141
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/revolution/css/navigation.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.151
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/fonts/poppins/poppins-v5-latin-700.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.156
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/fonts/poppins/poppins-v5-latin-regular.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.139
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/css/main.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.131
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/mdi-font/fonts/Material-Design-Iconic-Fontd1f1.woff2?v=2.2.0 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.129
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/themify-font/fonts/themify9f24.woff?-fvbane HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.191
country_id: 3469034
description:
Jan 15 18:17:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.191 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/keyword/images/article.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.28.90
country_id: 3469034
description:
Jan 15 18:18:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.28.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
country_id: 99237
description:
Jan 15 18:17:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2026-01-15 18:17:40 dovecot_plain authenticator failed for H=(diess) [65.20.149.93]:54104: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.199.219
country_id: 3865483
description:
Jan 15 18:18:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.199.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.97.36
country_id: 3469034
description:
Jan 15 18:18:42 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.97.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.238.196.144
country_id: 99237
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-41.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.28.90
country_id: 3469034
description:
Jan 15 18:18:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.28.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.250.117.128
country_id: 3996063
description:
[2026-01-15 18:19:50 +0800] info [whostmgrd] 187.250.117.128 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/news.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.56.240.143
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/process/Exception/ExceptionInterface.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.48
country_id: 2300660
description:
Jan 15 18:22:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.240.44.196
country_id: 798544
description:
Jan 15 18:22:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.240.44.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 18:24:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57013: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.10.129.230
country_id: 1643084
description:
[2026-01-15 18:24:59 +0800] info [whostmgrd] 182.10.129.230 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 18:24:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57014: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 20.215.214.18
country_id: 798544
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/pcp.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.253.181
country_id: 3469034
description:
Jan 15 18:27:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.253.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.47.16
country_id: 3469034
description:
Jan 15 18:30:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.47.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.231
country_id: 3469034
description:
Jan 15 18:31:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.47.16
country_id: 3469034
description:
Jan 15 18:30:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.47.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.111.103
country_id: 798544
description:
Jan 15 18:30:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.111.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.231
country_id: 3469034
description:
Jan 15 18:31:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 18:32:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64859: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.220.193
country_id: 3469034
description:
Jan 15 18:32:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.220.193 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 128.106.168.241
country_id: 1880251
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul style=\"margin-top: 0in;\" type=\"disc\">\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">update report for export &amp; import schedule (new order &amp; update existing order).&nbsp;</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">share coo to sejoong.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">vet draft bl from bvt.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">arrange container truck in with hk awards.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send vessel details to hkjc.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up draft docs from whitby.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up draft docs from havens.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">vet draft docs from havens.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send import schedule to tpl team.&nbsp;</span></li>\r\n</ul>||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 18:32:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64860: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.71.46
country_id: 1512440
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-6.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.109.137
country_id: 3469034
description:
Jan 15 18:37:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.109.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.109.137
country_id: 3469034
description:
Jan 15 18:37:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.109.137 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cert.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.100
country_id: 1269750
description:
Jan 15 18:41:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 49.149.135.17
country_id: 1694008
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p>&nbsp;</p>\r\n<ul>\r\n<li data-start=\"148\" data-end=\"272\"><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">january 15,2026</span></li>\r\n<li data-start=\"148\" data-end=\"272\">\r\n<p data-start=\"150\" data-end=\"272\"><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">prepared and forwarded itr 1&ndash;3 qtr 2025 to diana for business permit requirements, including provision of sales figures.</span></p>\r\n</li>\r\n<li style=\"font-family: 'trebuchet ms', geneva, sans-serif;\" data-start=\"273\" data-end=\"385\">\r\n<p data-start=\"275\" data-end=\"385\"><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">prepared payroll using kami (finalized) for january 1st half 2026 and updated employees&rsquo; files individually.</span></p>\r\n</li>\r\n<li style=\"font-family: 'trebuchet ms', geneva, sans-serif;\" data-start=\"386\" data-end=\"433\">\r\n<p data-start=\"388\" data-end=\"433\"><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">prepared dollar reports and required forms.</span></p>\r\n</li>\r\n<li style=\"font-family: 'trebuchet ms', geneva, sans-serif;\" data-start=\"434\" data-end=\"686\">\r\n<p data-start=\"436\" data-end=\"686\"><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">installation are done already with 10 laptops ( except kuya norman), then now continuously coordinated with qne regarding the re-training schedule; requested the timetable for all departments&rsquo; time scheming and followed up on confirmation for february 2&ndash;6, 2026(confirmed), for trainer availability to conduct onsite and online training.</span></p>\r\n</li>\r\n<li style=\"font-family: 'trebuchet ms', geneva, sans-serif;\" data-start=\"687\" data-end=\"886\">\r\n<p data-start=\"689\" data-end=\"886\"><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">reminded and provided instructions to angeline regarding resignation documentation and clearance of argem, issuance of last paycheck, and submitted the payslip to angeline for voucher processing.</span></p>\r\n</li>\r\n<li style=\"font-family: 'trebuchet ms', geneva, sans-serif;\" data-start=\"887\" data-end=\"915\">\r\n<p data-start=\"889\" data-end=\"915\"><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">signed accounting files.</span></p>\r\n</li>\r\n<li style=\"font-family: 'trebuchet ms', geneva, sans-serif;\" data-start=\"916\" data-end=\"944\">\r\n<p data-start=\"918\" data-end=\"944\"><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">followed up on incentives.</span></p>\r\n</li>\r\n</ul>||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.22
country_id: 3175395
description:
Jan 15 18:41:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.100
country_id: 1269750
description:
Jan 15 18:41:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.143.52
country_id: 2963597
description:
Jan 15 18:46:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.143.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.151
country_id: 3175395
description:
Jan 15 18:46:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.219.32.77
country_id: 6252001
description:
[2026-01-15 18:47:52 +0800] info [whostmgrd] 98.219.32.77 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.245.106.61
country_id: 6252001
description:
Jan 15 18:51:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.245.106.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.245.106.61
country_id: 6252001
description:
2026-01-15 18:51:57 dovecot_login authenticator failed for H=(localhost.localdomain) [172.245.106.61]:57609: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 18:52:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57029: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 18:52:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57030: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 18:52:26 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.147
country_id: 1269750
description:
Jan 15 18:53:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.147
country_id: 1269750
description:
Jan 15 18:53:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 18:56:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.85
country_id: 2510769
description:
Jan 15 18:58:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 19:00:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58133: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.114.187
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-00.89.110.114.187||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 19:00:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58134: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.136.54.7
country_id: 614540
description:
Jan 15 19:00:36 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.136.54.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.53
country_id: 3469034
description:
Jan 15 19:02:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.53 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.3.34.199
country_id: 2017370
description:
[2026-01-15 19:02:40 +0800] info [whostmgrd] 62.3.34.199 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.20.230.23
country_id: 3469034
description:
Jan 15 19:02:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.20.230.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.52
country_id: 3469034
description:
Jan 15 19:02:52 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.52 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.114.187
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-02.89.110.114.187||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.167
country_id: 1269750
description:
Jan 15 19:03:26 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.73.188
country_id: 6252001
description:
Jan 15 19:03:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.73.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.67
country_id: 3175395
description:
Jan 15 19:04:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.67 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.70.240.93
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/17html.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.234.178.190
country_id: 3469034
description:
Jan 15 19:04:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.234.178.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.160
country_id: 6290252
description:
Jan 15 19:05:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.254.20.233
country_id: 1814991
description:
2026-01-15 19:05:35 dovecot_login authenticator failed for H=(190-2-143-54.hosted-by-worldstream.net) [183.254.20.233]:2081: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.134.43
country_id: 3469034
description:
Jan 15 19:05:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.134.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.73.188
country_id: 6252001
description:
Jan 15 19:05:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.73.188 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 151.80.133.130
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/img/img/demos/img/demos/news.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.191
country_id: 3469034
description:
Jan 15 19:07:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.144.50.202
country_id: 1814991
description:
Jan 15 19:08:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.144.50.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.191
country_id: 1269750
description:
Jan 15 19:08:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.163.252.244
country_id: 1814991
description:
Jan 15 19:08:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.163.252.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.159.230
country_id: 1835841
description:
2026-01-15 19:08:31 dovecot_login authenticator failed for H=([220.72.159.230]) [220.72.159.230]:38216: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.72.159.230
country_id: 1835841
description:
Jan 15 19:08:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.72.159.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.144.50.202
country_id: 1814991
description:
2026-01-15 19:09:00 dovecot_login authenticator failed for H=([219.144.50.202]) [219.144.50.202]:54846: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.2
country_id: 3175395
description:
Jan 15 19:09:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.112.205.199
country_id: 2328926
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/shop-single.php?id=2120 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.163.252.244
country_id: 1814991
description:
2026-01-15 19:08:20 dovecot_login authenticator failed for H=([220.163.252.244]) [220.163.252.244]:51527: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.202.50.164
country_id: 1269750
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/product-details-acp.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.2
country_id: 3175395
description:
Jan 15 19:09:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.137
country_id: 3469034
description:
Jan 15 19:10:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.149
country_id: 3469034
description:
Jan 15 19:13:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.149 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.237.31
country_id: 130758
description:
2026-01-15 19:14:29 120886 [Warning] Aborted connection 120886 to db: 'unconnected' user: 'unauthenticated' host: '195.24.237.31' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.118
country_id: 798544
description:
Jan 15 19:14:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.104
country_id: 3469034
description:
Jan 15 19:14:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.149
country_id: 3469034
description:
Jan 15 19:14:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.172
country_id: 3865483
description:
Jan 15 19:14:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.172 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.42.108
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-16.142.111.42.108||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.170.179.36
country_id: 1562822
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/p-8.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.237.31
country_id: 130758
description:
2026-01-15 19:17:51 121114 [Warning] Aborted connection 121114 to db: 'unconnected' user: 'unauthenticated' host: '195.24.237.31' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/survey-meter.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 19:20:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57051: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.98.65
country_id: 3469034
description:
Jan 15 19:21:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.98.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 19:20:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57052: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/img/photos/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.98.65
country_id: 3469034
description:
Jan 15 19:21:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.98.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.52
country_id: 798544
description:
Jan 15 19:21:31 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.37
country_id: 3469034
description:
Jan 15 19:21:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.37 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.30.120
country_id: 933860
description:
Jan 15 19:22:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.30.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.234
country_id: 3865483
description:
Jan 15 19:23:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.234 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.190.117.40
country_id: 2017370
description:
[2026-01-15 19:23:59 +0800] info [whostmgrd] 94.190.117.40 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.234
country_id: 3865483
description:
Jan 15 19:23:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.30.120
country_id: 933860
description:
Jan 15 19:23:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.30.120 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.237.31
country_id: 130758
description:
2026-01-15 19:23:23 121329 [Warning] Aborted connection 121329 to db: 'unconnected' user: 'unauthenticated' host: '195.24.237.31' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.67.190.16
country_id: 1814991
description:
2026-01-15 19:25:16 dovecot_login authenticator failed for H=(16.190.67.125.broad.gz.sc.dynamic.163data.com.cn) [125.67.190.16]:36858: 535 Incorrect authentication data (set_id=lkwong.isc@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.87.152
country_id: 1814991
description:
Jan 15 19:26:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.87.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.152
country_id: 1814991
description:
2026-01-15 19:26:12 dovecot_login authenticator failed for H=([111.61.87.152]) [111.61.87.152]:13716: 535 Incorrect authentication data (set_id=nurhidayati@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 19:28:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58304: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 19:28:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58308: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.64.154
country_id: 3895114
description:
[2026-01-15 19:30:40 +0800] info [whostmgrd] 179.60.64.154 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.72.35
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-37.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.114
country_id: 3469034
description:
Jan 15 19:35:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.181
country_id: 1269750
description:
Jan 15 19:42:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.240.209
country_id: 1269750
description:
Jan 15 19:43:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.240.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.97.251.240
country_id: 798544
description:
Jan 15 19:44:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.97.251.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.240.209
country_id: 1269750
description:
Jan 15 19:44:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.240.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.242.125.186
country_id: 798544
description:
Jan 15 19:44:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.242.125.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.129
country_id: 2963597
description:
Jan 15 19:45:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.25.132.93
country_id: 1269750
description:
Jan 15 19:44:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.25.132.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.129
country_id: 2963597
description:
Jan 15 19:45:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.59.132.17
country_id: 798544
description:
Jan 15 19:45:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.59.132.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.97.251.240
country_id: 798544
description:
Jan 15 19:45:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.97.251.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.218
country_id: 1269750
description:
Jan 15 19:46:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.218 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 104.248.52.172
country_id: 6252001
description:
2026-01-15 19:46:53 122339 [Warning] Aborted connection 122339 to db: 'unconnected' user: 'unauthenticated' host: '104.248.52.172' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 19:48:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57071: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 19:48:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57072: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.168
country_id: 1269750
description:
Jan 15 19:48:36 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.168 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.50.83.37
country_id: 2464461
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=86491516693580 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.165
country_id: 3077311
description:
Jan 15 19:49:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.165 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.24.109.96
country_id: 3469034
description:
[2026-01-15 19:50:51 +0800] info [whostmgrd] 191.24.109.96 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.177.200.228
country_id: 3865483
description:
Jan 15 19:50:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.177.200.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.203
country_id: 732800
description:
Jan 15 19:51:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.203 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 130.193.204.119
country_id: 99237
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/Scotsman.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.203
country_id: 732800
description:
Jan 15 19:52:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.203.172
country_id: 3469034
description:
Jan 15 19:52:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.203.172 has been locked due to Imunify RBL


